Security Vulnerabilities
A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges.
CVSS Score
8.4
EPSS Score
0.0
Published
2025-12-23
Cadmium CMS v.0.4.9 has a background arbitrary file upload vulnerability in /admin/content/filemanager/uploads.
CVSS Score
9.8
EPSS Score
0.0
Published
2025-12-23
A stack overflow in the src/main.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted input into the filename parameter.
CVSS Score
6.2
EPSS Score
0.0
Published
2025-12-23
Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.
CVSS Score
4.0
EPSS Score
0.0
Published
2025-12-23
SQL Injection vulnerability in RuoYi v.4.7.9 and before allows a remote attacker to execute arbitrary code via the createTable function in SqlUtil.java.
CVSS Score
10.0
EPSS Score
0.003
Published
2025-12-23
Linksys E5600 V1.1.0.26 is vulnerable to command injection in the runtime.macClone function via the mc.ip parameter.
CVSS Score
9.8
EPSS Score
0.003
Published
2025-12-23
linksys E5600 V1.1.0.26 is vulnerable to command injection in the function ddnsStatus.
CVSS Score
9.8
EPSS Score
0.003
Published
2025-12-23
Improper verification of the time certificate in Eclipse Cyclone DDS before v0.10.5 allows attackers to bypass certificate checks and execute commands with System privileges.
CVSS Score
10.0
EPSS Score
0.001
Published
2025-12-23
An integer overflow in the RTPS protocol implementation of OpenDDS DDS before v3.33.0 allows attackers to cause a Denial of Service (DoS) via a crafted message.
CVSS Score
7.5
EPSS Score
0.001
Published
2025-12-23
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the iface parameter in the action_bandwidth function.
CVSS Score
6.5
EPSS Score
0.033
Published
2025-12-23