CVE-2025-58405 - Lack of protection mechanisms against Clickjacking attacks
CVE ID : CVE-2025-58405
Published : March 2, 2026, 11:16 a.m. | 15 minutes ago
Description : The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-58405
Published : March 2, 2026, 11:16 a.m. | 15 minutes ago
Description : The CGM CLININET application does not implement any mechanisms that prevent clickjacking attacks, neither HTTP security headers nor HTML-based frame‑busting protections were detected. As a result, an attacker can embed the application inside a maliciously crafted IFRAME and trick users into performing unintended actions, including potentially bypassing CSRF/XSRF defenses.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-58406 - Lack of HTTP Response Headers
CVE ID : CVE-2025-58406
Published : March 2, 2026, 11:16 a.m. | 15 minutes ago
Description : The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-58406
Published : March 2, 2026, 11:16 a.m. | 15 minutes ago
Description : The CGM CLININET application respond without essential security HTTP headers, exposing users to client‑side attacks such as clickjacking, MIME sniffing, unsafe caching, weak cross‑origin isolation, and missing transport security controls.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-12462 - Blind SQL Injection in DobryCMS
CVE ID : CVE-2025-12462
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-12462
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : A Blind SQL injection vulnerability has been identified in DobryCMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path resulting in Blind SQL Injection. This issue was fixed in versions above 8.0.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-14532 - Remote Code Execution via Unrestricted File Upload in DobryCMS
CVE ID : CVE-2025-14532
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-14532
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can result in Remote Code Execution. This issue was fixed in versions above 5.0.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-3431 - Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
CVE ID : CVE-2026-3431
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-3431
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-3432 - Sim Studio AI - Unauthenticated OAuth Token Theft
CVE ID : CVE-2026-3432
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-3432
Published : March 2, 2026, 1:16 p.m. | 17 minutes ago
Description : On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `credentialAccountUserId` and `providerId` parameters. An unauthenticated attacker can retrieve OAuth access tokens for any user by supplying their user ID and a provider name, effectively stealing credentials to third-party services.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-47381 - Use After Free in Automotive Audio
CVE ID : CVE-2025-47381
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47381
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-47383 - Missing Cryptographic Step in Data Modem
CVE ID : CVE-2025-47383
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47383
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-47384 - Reachable Assertion in FW
CVE ID : CVE-2025-47384
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Transient DOS when MAC configures config id greater than supported maximum value.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47384
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Transient DOS when MAC configures config id greater than supported maximum value.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-47385 - Improper Access Control for Register Interface in SCE-Mink
CVE ID : CVE-2025-47385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when accessing trusted execution environment without proper privilege check.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when accessing trusted execution environment without proper privilege check.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-47386 - Use After Free in Automotive Audio
CVE ID : CVE-2025-47386
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-47386
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-59600 - Buffer Over-read in Graphics
CVE ID : CVE-2025-59600
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when adding user-supplied data without checking available buffer space.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-59600
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when adding user-supplied data without checking available buffer space.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-59603 - Out-of-bounds Write in Computer Vision
CVE ID : CVE-2025-59603
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when processing invalid user address with nonstandard buffer address.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-59603
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory Corruption when processing invalid user address with nonstandard buffer address.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-64427 - ZimaOS is vulnerable to Server-Side Request Forgery (SSRF)
CVE ID : CVE-2025-64427
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-64427
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prior, due to insufficient validation or restriction of target URLs, an authenticated local user can craft requests that target internal IP addresses (e.g., 127.0.0.1, localhost, or private network ranges). This allows the attacker to interact with internal HTTP/HTTPS services that are not intended to be exposed externally or to local users. No known patch is publicly available.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-70252 - Tenda AC6 Stack Overflow Vulnerability
CVE ID : CVE-2025-70252
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-70252
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable. If the conditions are met to sprintf, they will be spliced into tmp. It is worth noting that there is no size check,which leads to a stack overflow vulnerability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-21385 - Integer Overflow or Wraparound in Graphics
CVE ID : CVE-2026-21385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory corruption while using alignments for memory allocation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-21385
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : Memory corruption while using alignments for memory allocation.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-23865 - Freetype Integer Overflow Out-of-Bounds Read Vulnerability
CVE ID : CVE-2026-23865
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-23865
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13.3 may allow for an out of bounds read operation when parsing HVAR/VVAR/MVAR tables in OpenType variable fonts. This issue is fixed in version 2.14.2.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-24105 - Tenda AC15 Command Injection Vulnerability
CVE ID : CVE-2026-24105
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-24105
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not checked, potentially leading to a command injection vulnerability if injected into doSystemCmd.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-26700 - Sourcecodester Personnel Property Equipment System SQL Injection Vulnerability
CVE ID : CVE-2026-26700
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-26700
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-26708 - Sourcecodester Pharmacy Point of Sale System SQL Injection Vulnerability
CVE ID : CVE-2026-26708
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-26708
Published : March 2, 2026, 5:16 p.m. | 18 minutes ago
Description : sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2026-28286 - ZimaOS: Unauthorized Creation of Files/Folders in Restricted System Directories via API
CVE ID : CVE-2026-28286
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2026-28286
Published : March 2, 2026, 5:16 p.m. | 17 minutes ago
Description : ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other sensitive system directories, the API successfully creates files or directories in locations where normal users should have no write access. This indicates that the API does not properly validate the target path, allowing unauthorized operations on critical system directories. No known patch is publicly available.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...