Open Source Vulnerabilities

imagemagick, imagemagick, imagemagick

libnxml, libnxml, libnxml

ebook-speaker, ebook-speaker, ebook-speaker

mattermost-fips-12.1

mattermost-fips-12.1

qemu-doc, qemu-doc

qemu-doc, qemu-doc

FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls

org.springframework:spring-core

TuxCare security update for org.springframework:spring-core (1 CVE)

mattermost-12.1

mattermost-12.1

mattermost-12.1

mattermost-12.1

org.springframework:spring-expression, org.springframework:spring-web

TuxCare security update for org.springframework (2 CVEs)

FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences

prometheus-fips-3.16

prometheus-fips-3.16

prometheus-fips-3.16

prometheus-fips-3.16

prometheus-fips-3.16

prometheus-fips-3.16

FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user

org.springframework:spring-expression, org.springframework:spring-webmvc

TuxCare security update for org.springframework (2 CVEs)

SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

SuiteCRM: Privilege escalation via V8 REST modules (ACLRoles, ACLActions, Administration)

SuiteCRM: Authenticated SQL Injection In action_get_end_date function

ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder

mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata

ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator

langgenius dify Sandbox Run __init__.py hard-coded credentials

SuiteCRM: V8 OAuth2 Username Enumeration

org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (7 CVEs)

SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list

SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record

SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)

SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack

SuiteCRM: Time-Based Blind SQL Injection via AOR_Reports ORDER BY Clause Allows Data Exfiltration by Any Authenticated User

SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full database

org.springframework:spring-beans, org.springframework:spring-expression, org.springframework:spring-web, org.springframework:spring-webflux, org.springframework:spring-webmvc

TuxCare security update for org.springframework (8 CVEs)

SuiteCRM: LFI to RCE via AOW_WorkFlow

SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship Management

org.springframework:spring-core, org.springframework:spring-web, org.springframework:spring-webmvc

TuxCare security update for org.springframework (4 CVEs)

SuiteCRM: SQL injection via search param in modules/Cases/controller.php

SuiteCRM: Authenticated SQL Injection in map_markers distance Parameter

SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.php

SuiteCRM: AOR Reports aor_fields.field SQL Injection

SuiteCRM: Authenticated SQL Injection In handleAttachments function

SuiteCRM: Authenticated SQL Injection In Project Module

SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php

SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response Disclosure