A critical flaw in Ivanti Neurons Patch for Intune allows remote authenticated attackers to leak sensitive authentication data via an exposed dangerous endpoint.
A critical authentication bypass in obsidian-tc allows any valid user token to read, write, or delete data in any configured vault prior to version 1.3.1.
A critical authentication flaw in Netherman Portal allows unauthenticated attackers to hijack accounts by exploiting missing rate limits and verbose error messages.
A critical flaw in PraisonAI allows remote attackers to bypass authentication, access private context, and trigger agent workflows without any credentials.
Wordfence Argus identified a heap buffer overflow in Ghostscript that allows attackers to execute code on servers processing uploaded PDF documents.
A critical vulnerability in Crawl4AI allows attackers to bypass network boundaries and extract sensitive internal data through manipulated web scraping requests.
A CVSS 9.3 vulnerability in openapi-typescript-codegen lets attackers inject JavaScript through malicious OpenAPI documents, risking remote code execution in generated clients.
A critical identity flaw in Vikunja versions prior to 2.4.0 lets attackers use valid share links to scrape task data and user details from any project on the server.
Vikunja version 2.4.0 addresses a high-severity flaw where password-reset and other tokens were stored in plaintext, allowing database readers to hijack accounts.
A critical remote code execution vulnerability in IBM identity products allows authenticated attackers to take control of systems via a protection failure.
A critical path traversal bug in gvproxy lets attackers delete arbitrary host files via an unauthenticated endpoint, affecting Red Hat products.