CVE-2025-27xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
818 records · Page 8 of 9
in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input.
UpdatedWelcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may be executed by a remote unauthenticated attacker who can access websites created using the product.
UpdatedAn authentication bypass vulnerability exists in the HTTP authentication functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can send packets to trigger this vulnerability.
Updatedin OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free.
UpdatedA vulnerability has been identified in TIA Project-Server (All versions < V2.1.1), TIA Project-Server V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions < V19 Update 4), Totally Integrated Automation Portal (TIA Portal) V20
Updatedlibxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c.
Updated- CVE-2025-27112: Navidrome has authentication bypass in Subsonic API with non-existent username 6.9 Medium
Navidrome is an open source web-based music collection server and streamer. Starting in version 0.52.0 and prior to version 0.54.5, in certain Subsonic API endpoints, a flaw in the authentication check process allows an attacker to specify any arbitrary username that does not exist on the system, along with a salted hash of an empty password. Under these conditions, Navidrome treats the request as
Updated - CVE-2025-27111: Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection 6.9 Medium
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the header, resulting in log injection. This vulnerability is fixed in 2.2.12, 3.0.13, and 3.1.11.
Updated Libmodsecurity is one component of the ModSecurity v3 project. The library codebase serves as an interface to ModSecurity Connectors taking in web traffic and applying traditional ModSecurity processing. A bug that exists only in Libmodsecurity3 version 3.0.13 means that, in 3.0.13, Libmodsecurity3 can't decode encoded HTML entities if they contains leading zeroes. Version 3.0.14 contains a fix. N
Updatedsolid-js is a declarative, efficient, and flexible JavaScript library for building user interfaces. In affected versions Inserts/JSX expressions inside illegal inlined JSX fragments lacked escaping, allowing user input to be rendered as HTML when put directly inside JSX fragments. This issue has been addressed in version 1.9.4 and all users are advised to upgrade. There are no known workarounds fo
Updateddom-expressions is a Fine-Grained Runtime for Performant DOM Rendering. In affected versions the use of javascript's `.replace()` opens up to potential Cross-site Scripting (XSS) vulnerabilities with the special replacement patterns beginning with `$`. Particularly, when the attributes of `Meta` tag from solid-meta are user-defined, attackers can utilise the special replacement patterns, either `$
Updated- CVE-2025-27107: Integrated Scripting vulnerable to arbitrary code execution via Java reflection 8.6 High
Integrated Scripting is a tool for creating scripts for handling complex operations in Integrated Dynamics. Minecraft users who use Integrated Scripting prior to versions 1.21.1-1.0.17, 1.21.4-1.0.9-254, 1.20.1-1.0.13, and 1.19.2-1.0.10 may be vulnerable to arbitrary code execution. By using Java reflection on a thrown exception object it's possible to escape the JavaScript sandbox for IntegratedS
Updated binance-trading-bot is an automated Binance trading bot with trailing buy/sell strategy. Authenticated users of binance-trading-bot can achieve Remote Code Execution on the host system due to a command injection vulnerability in the `/restore` endpoint. The restore endpoint of binance-trading-bot is vulnerable to command injection via the `/restore` endpoint. The name of the uploaded file is passe
Updatedvyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been add
Updatedvyper is a Pythonic Smart Contract Language for the EVM. Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body (e.g. read a storage variable updated in the loop body) and thus lead to unexpected program behavior. Specifically, reads in iterators
UpdatedDataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.6, a bypass for the patch for CVE-2024-55953 allows authenticated users to read and deserialize arbitrary files through the background JDBC connection. The vulnerability has been fixed in v2.10.6. No known workarounds are available.
Updated- CVE-2025-27102: Agate vulnerable to HTML injection in user signup - Administrator phishing risk 5.4 Medium
Agate is central authentication server software for OBiBa epidemiology applications. Prior to version 3.3.0, when registering for an Agate account, arbitrary HTML code can be injected into a user's first and last name. This HTML is then rendered in the email sent to administrative users. The Agate service account sends this email and appears trustworthy, making this a significant risk for phishing
Updated - CVE-2025-27101: Broken Access Control in Opal filesystem's copy functionality exposes all user data 7.3 High
Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the /temp/ directory, all files in that parent directory are copied, including files which the user should not have access to. All users of the application are impacted, as this is exploitable by any user to reveal all files in the opal filesys
Updated lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below are affected. Users are advised to upgrade. Users unable to upgrade should either
UpdatedTuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is
UpdatedGraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. Missing check vulnerability in the static file handler allows any client to access the files in the server's file system. When `staticFiles` is set in the `serve` settings
UpdatedGraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST and gRPC, and also databases such as MongoDB, MySQL, and PostgreSQL. When a user transforms on the root level or single source with transforms, and the client sends the same query with different variables, the initial variables are used in
Updated- CVE-2025-27096: SQL Injection endpoint 'html/personalizacao_upload.php' parameter 'id_campo' in WeGIA 9.4 Critical
WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personalizacao_upload.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There
Updated JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server controlled by the attacker. This allows the attacker to intercept and capture the Kubernetes cluster token.
UpdatedTuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute for the multiselectbox field, the default value, number of rows, and columns attributes for the text fi
UpdatedSliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be acc
UpdatedGHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered in GHOSTS version 8.0.0.0 that allows an attacker to access files outside of the intended directory through the photo retrieval endpoint. The vulnerability exists in the /api/npcs/{id}/photo endpoint, which is designed to serve profile phot
UpdatedOpenH264 is a free license codec library which supports H.264 encoding and decoding. A vulnerability in the decoding functions of OpenH264 codec library could allow a remote, unauthenticated attacker to trigger a heap overflow. This vulnerability is due to a race condition between a Sequence Parameter Set (SPS) memory allocation and a subsequent non Instantaneous Decoder Refresh (non-IDR) Network
UpdatedSliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The reverse port forwarding in sliver teamserver allows the implant to open a reverse tunnel on the sliver teamserver without verifying if the operator instructed the implant to do so. The only impact that has been shown is the exposure of the se
UpdatedDirectus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` action that allow access to different fields, instead of correctly checking access permissions against the item they apply for the user is allowed to update the superset of fields allowed by any of the policies. E.g. have one policy allowing u
Updatedoxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create malicious URLs that, when visited, inject scripts into the web application. This can lead to session hijacking or phishing attacks on a trusted domain, posing a moderate risk to all users. It's possible to inject html elements, including script
UpdatedA vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack.
UpdatedA vulnerability in the HPE Performance Cluster Manager (HPCM) GUI could allow an attacker to bypass authentication.
UpdatedMultiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vulnerabilities could allow an authenticated, remote attacker to download arbitrary files from the filesystem of an affected device.
UpdatedA vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack. Successful exploitation could enable the attacker to execute arbitrary script code in the victim's browser within the context of the affected interface.
UpdatedAuthenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful exploitation of these vulnerabilities allows an Authenticated attacker to execute arbitrary commands as a privileged user on the underlying operating system.
UpdatedArbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlying host operating system.
Updated- CVE-2025-27081: HPE NonStop OSM Service Connection Suite, Denial of Service vulnerability 6.8 Medium
A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service.
Updated Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation could allow an attacker to gain unauthorized access to services outside of the impacted switch, potentially leading to lateral movement involving those services.
UpdatedA vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution (RCE). Successful exploitation could allow an attacker to execute arbitrary operating system commands on the underlying operating system leading to potential system compromise.
UpdatedA vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise.
UpdatedMemory corruption while processing message in guest VM.
UpdatedMemory corruption while processing simultaneous requests via escape path.
UpdatedMemory corruption while processing IOCTL command with larger buffer in Bluetooth Host.
UpdatedMemory corruption while processing a GP command response.
UpdatedTransient DOS while creating NDP instance.
Updated- CVE-2025-27072: Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks 5.5 Medium
Information disclosure while processing a packet at EAVB BE side with invalid header length.
Updated - CVE-2025-27071: Buffer Copy Without Checking Size of Input in Powerline Communication Firmware 7.3 High
Memory corruption while processing specific files in Powerline Communication Firmware.
Updated Memory corruption while performing encryption and decryption commands.
UpdatedMemory corruption while processing DDI command calls.
UpdatedMemory corruption while processing an IOCTL command with an arbitrary address.
UpdatedMemory corruption while processing DDI call with invalid buffer.
UpdatedTransient DOS while processing an ANQP message.
UpdatedTransient DOS while processing a frame with malformed shared-key descriptor.
UpdatedInformation disclosure while registering commands from clients with diag through diagHal.
UpdatedMemory corruption during video playback when video session open fails with time out error.
UpdatedMemory corruption while handling client exceptions, allowing unauthorized channel access.
UpdatedMemory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
UpdatedMemory corruption while performing SCM call with malformed inputs.
UpdatedMemory corruption while performing SCM call.
UpdatedMemory corruption while processing packet data with exceedingly large packet.
UpdatedTransient DOS while handling beacon frames with invalid IE header length.
UpdatedMemory corruption during sub-system restart while processing clean-up to free up resources.
UpdatedMemory corruption during the image encoding process.
UpdatedMemory corruption while processing a malformed license file during reboot.
UpdatedMemory corruption during PlayReady APP usecase while processing TA commands.
UpdatedMemory corruption while processing data packets in diag received from Unix clients.
UpdatedMemory corruption while processing command message in WLAN Host.
UpdatedMemory corruption while processing event close when client process terminates abruptly.
Updated- CVE-2025-27049: Buffer Over-read in Camera 5.5 Medium
Transient DOS while processing IOCTL call for image encoding.
Updated Memory corruption while processing camera platform driver IOCTL calls.
UpdatedMemory corruption while processing the TESTPATTERNCONFIG escape path.
UpdatedMemory corruption while processing multiple simultaneous escape calls.
Updated- CVE-2025-27045: Buffer Over-read in Video 6.1 Medium
Information disclosure while processing batch command execution in Video driver.
Updated Memory corruption while executing timestamp video decode command with large input values.
UpdatedMemory corruption while processing manipulated payload in video firmware.
UpdatedMemory corruption while processing video packets received from video firmware.
Updated- CVE-2025-27041: Buffer Over-read in Video 5.5 Medium
Transient DOS while processing video packets received from video firmware.
Updated Information disclosure may occur while processing the hypervisor log.
UpdatedMemory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.
UpdatedMemory corruption while rendering graphics using Adreno GPU drivers in Chrome.
UpdatedMemory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.
Updated- CVE-2025-27036: Buffer Over-read in Video 6.1 Medium
Information disclosure when Video engine escape input data is less than expected minimum size.
Updated Memory corruption while selecting the PLMN from SOR failed list.
Updated- CVE-2025-27033: Buffer Over-read in Video 6.1 Medium
Information disclosure while running video usecase having rogue firmware.
Updated - CVE-2025-27032: Improper Access Control Applied to Mirrored or Aliased Memory Regions in Hypervisor 7.8 High
memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.
Updated memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.
Updated- CVE-2025-27030: Buffer Over-read in Audio 6.1 Medium
information disclosure while invoking calibration data from user space to update firmware size.
Updated Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.
UpdatedThe Linux deprivileged user vpuser in Radiflow iSAP Smart Collector (CentOS 7 - VSAP 1.20) can read the entire file system content, including files belonging to other users and having restricted access (like, for example, the root password hash).
UpdatedA user with vpuser credentials that opens an SSH connection to the device, gets a restricted shell rbash that allows only a small list of allowed commands. This vulnerability enables the user to get a full-featured Linux shell, bypassing the rbash restrictions.
UpdatedA missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but deactivates also Linux Shell, WebGUI and Physical Serial Console access. No confirmation is asked at deacti
UpdatedThe target device exposes a service on a specific TCP port with a configured endpoint. The access to that endpoint is granted using a Basic Authentication method. The endpoint accepts also the PUT method and it is possible to write files on the target device file system. Files are written as root. Using Postman it is possible to perform a Directory Traversal attack and write files into any lo
UpdatedUnrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections. Details: Account members of the Network Administrator profile can access the target machine via SFTP with the same credentials used for SSH CLI access and are able to read all files according to the OS permission instead of remain
UpdatedLack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands. Details: The web interface based management of the Infinera G42 appliance enables the feature of executing a restricted set of commands. This feature also offers the option to execute a script-file already present on the target
UpdatedA path traversal vulnerability of the WebGUI HTTP endpoint in Infinera G42 version R6.1.3 allows remote authenticated users to download all OS files via HTTP requests. Details: Lack or insufficient validation of user-supplied input allows authenticated users to access all files on the target machine file system that are readable to the user account used to run the httpd service.
UpdatedThe misconfiguration in the sudoers configuration of the operating system in Infinera G42 version R6.1.3 allows low privileged OS users to read/write physical memory via devmem command line tool. This could allow sensitive information disclosure, denial of service, and privilege escalation by tampering with kernel memory. Details: The output of "sudo -l" reports the presence of "devmem" com
UpdatedImproper configuration of the SSH service in Infinera MTC-9 allows an unauthenticated attacker to execute arbitrary commands and access data on file system . This issue affects MTC-9: from R22.1.1.0275 before R23.0.
UpdatedRemote shell service (RSH) in Infinera MTC-9 version R22.1.1.0275 allows an attacker to utilize password-less user accounts and obtain system access by activating a reverse shell.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
Updated- CVE-2025-27018: Apache Airflow MySQL Provider: SQL injection in MySQL provider core function 6.3 Medium
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow MySQL Provider. When user triggered a DAG with dump_sql or load_sql functions they could pass a table parameter from a UI, that could cause SQL injection by running SQL that was not intended. It could lead to data corruption, modification and others. This issue affects Apache Airfl
Updated