Project AI is a platform designed to create AI agents. Prior to the pre-beta version, a hardcoded API key was present in the source code. This issue has been patched in the pre-beta version....

Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. In versions starting from 2.4.0 to before 2.38.0, an authenticated CVAT user may be able to retrieve the...

Next.js is a React framework for building full-stack web applications. In versions starting from 13.0 to before 15.2.2, Next.js may have allowed limited source code exposure when the dev server was running with the...

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher....

jhead v3.08 was discovered to contain a heap-use-after-free via the ProcessFile function at jhead.c. Assigner : cve@mitre.org More information : https://github.com/madao123123/crash_report/blob/main/jhead/jhead.md

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5Z__filter_scaleoffset function. Assigner : cve@mitre.org More information : https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc5.md

hdf5 v1.14.6 was discovered to contain a heap buffer overflow via the H5VM_memcpyvv function. Assigner : cve@mitre.org More information : https://github.com/madao123123/crash_report/blob/main/hdf5_poc/hdf5_poc1.md

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers to read or write to arbitrary database tables of generated sites. Assigner : cve@mitre.org More information : https://docs.lovable.dev/changelog

Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attackers to join the network without authentication. Assigner : cve@mitre.org More information : http://tinxy.com

Tinxy WiFi Lock Controller v1 RF was discovered to store users’ sensitive information, including credentials and mobile phone numbers, in plaintext. Assigner : cve@mitre.org More information : https://github.com/ShravanSinghRathore/Tinxy/wiki/1.-WiFi-Lock-Controller-v1-RF-%281%E2%80%909%29

Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control information and device credentials, allowing attackers to possibly intercept and access sensitive information via a man-in-the-middle attack. Assigner...

The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNC. This password cannot be...

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on...

Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if connected. Assigner : ics-cert@hq.dhs.gov More information : https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-04