Все уязвимости

OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node v

Windows AppX Deployment Service Security Feature Bypass Vulnerability

Improper Protection of Alternate Path in Splunk SOAR

Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote auth

Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass

Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared Presets

Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes

Missing authorization checks in Amazon Athena engine version 3 request handling

Arbitrary file read via the convert_playwright_script prompt in mcp-k6

copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstrac

PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace

AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private attributes

ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypassing path-scoped controls

Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)

Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false

In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI ma

Prisma Access Agent: Local Authenticated VPN Enforcement Bypass on Linux

AWS API MCP File Access Restriction Bypass

Container Escape Vulnerability in TR7's Application Security Platform (ASP)

Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) <= 5.6.3 - Form Submission Admin Email Bypass

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an

Prisma Browser: Insufficient Policy Enforcement Vulnerability in Prisma Browser

Yiiframework Yii Improper Protection of Alternate Path Vulnerability

Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.

Privilege Management for Windows - Elevation of Privilege

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a craf

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a rem

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template C

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protect