Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint ‘vets.wakyma.com/pets/print-tags'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose...

Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint ‘vets.wakyma.com/hospitalization/generate-hospitalization-summary'. This vulnerability could allow an authenticated user to alter a POST request to the affected endpoint for the purpose...

Non-relational SQL injection vulnerability (NoSQLi) in the Wakyma web application, specifically in the endpoint ‘vets.wakyma.com/centro/equipo/empleado'. This vulnerability could allow an authenticated user to alter a GET request to the affected endpoint for the purpose...

Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as changing the victim’s email address, validating the new email address, and requesting a...

libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. More information : https://github.com/libexpat/libexpat/pull/1159

libexpat before 2.7.5 allows an infinite loop while parsing DTD content. More information : https://github.com/libexpat/libexpat/issues/1161

libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. More information : https://github.com/libexpat/libexpat/pull/1158

libexif through 0.6.25 has a flaw in decoding MakerNotes. If the exif_mnote_data_get_value function gets passed in a 0 size, the passed in-buffer would be overwritten due to an integer underflow. More information : https://github.com/libexif/libexif/commit/7df372e9d31d7c993a22b913c813a5f7ec4f3692

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims’ browsers....

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR. More information : https://www.openwall.com/lists/oss-security/2026/03/13/1

Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower....

Runtipi is a personal homeserver orchestrator. Prior to 4.8.1, The Runtipi /api/auth/verify-totp endpoint does not enforce any rate limiting, attempt counting, or account lockout mechanism. An attacker who has obtained a user’s valid credentials...

PX4 autopilot is a flight control solution for drones. Prior to 1.17.0-rc1, a heap-use-after-free is detected in the MavlinkShell::available() function. The issue is caused by a race condition between the MAVLink receiver thread (which...

The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces). Prior to 0.2.1, due to a mis-written NetworkPolicy, a malicious actor can...