Mittel
CVE-2025-68113
Schwachstellenarchiv
Schwachstellen verstehen. Anwendungen schützen.
Erfahren Sie, welche Schwachstellen Ihre Technologien betreffen und wie Sie diese beheben. Hier finden Sie verständliche Erklärungen, betroffene Versionen und konkrete Empfehlungen - von CMS und Plugins bis zu Anwendungsbibliotheken.
Schwachstellenarchiv 6.861
Filter zurücksetzen
Mittel
CVE-2025-66407
Weblate has a Server-Side Request Forgery issue
Mittel
CVE-2025-65430
An issue was discovered in allauth-django before 65.13.0. IdP: marking a user as is_active=False after having handed tokens for that user while the account was still active had no effect. Fixed the ac
Mittel
CVE-2025-65431
An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferred_username as the identifier for third-party provider accounts. That value may be mutable and should th
Mittel
CVE-2025-66388
A vulnerability in Apache Airflow allowed authenticated UI users to view secret values in rendered templates due to secrets not being properly redacted, potentially exposing secrets to users without t
Mittel
CVE-2025-14692
A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attac
Mittel
CVE-2025-14691
A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be p
Hoch
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
Mittel
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
Hoch
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Kritisch
CVE-2025-13780
pgadmin4 has a Meta-Command Filter Command Execution
Kritisch
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Kritisch
CVE-2025-65548
NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by t
Hoch
In Angriffen ausgenutzt
CVE-2025-34291
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with all
Niedrig
CVE-2025-63681
open-webui is Vulnerable to Incorrect Access Control
Mittel
CVE-2025-64460
Django is vulnerable to DoS via XML serializer text extraction
Mittel
CVE-2025-13372
Django is vulnerable to SQL injection in column aliases
Mittel
CVE-2025-13742
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Niedrig
CVE-2025-65681
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-contr
Niedrig
ghsa-j4gv-6x9v-v23g
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
Hoch
CVE-2025-13609
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent'
Mittel
CVE-2025-62609
MLX has Wild Pointer Dereference in load_gguf()
Mittel
CVE-2025-62608
MLX has heap-buffer-overflow in load()
Mittel
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
Erkennen Sie Schwachstellen in Ihrer Anwendung
Mit der DockRay-Integration und aktivierter Softwareinventarisierung prüft DockRay gemeldete Komponentenversionen auf bekannte Schwachstellen und benachrichtigt Sie über bestätigte Treffer. Die Abdeckung hängt von der unterstützten Technologie und den verfügbaren Meldungen ab.