CVE Brief Security Intelligence

Use after free in Extensions in Google Chrome prior to 139

Use after free in Cast in Google Chrome prior to 139

The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4

Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user

The /users endpoint in Statamic Core before 2

Microsoft 365 Copilot BizChat Information Disclosure Vulnerability

In Xerox FreeFlow Core version 8

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune

EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access

The installer for SAN Host Utilities for Windows versions prior to 8

Authentication Bypass Using an Alternate Path or Channel vulnerability in WPExperts Post SMTP allows Authentication Bypass

skops is a Python library which helps users share and ship their scikit-learn based models

The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (remote, cloud-connected interface) or via a serial connection, and can install these files without integrity checks

A TLS vulnerability exists in the phone application used to manage a connected device

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm

Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index

Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func3

Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the doctor_contact parameter in doctorsearch

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application

A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2

MiR software versions prior to version 3

A vulnerability in the Suite Applications Services component of Mitel MiCollab 10

In GStreamer through 1

The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number

GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory

On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP

LinkJoin through 882f196 mishandles lacks type checking in password reset

LinkJoin through 882f196 mishandles token ownership in password reset

IBM i 7

OpenMetadata <=1

OpenMetadata <=1

Cancelling a query (e