2022

The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, wh

The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which c

The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings,

The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could

The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the p

The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted reque

The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, wh

The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor do

Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an at

The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filen

The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high

The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow hig

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o

The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, lea

The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter

The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high

The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL sta

The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL stateme

The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e

The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting t

Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated att

Adobe Media Encoder version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated att

Adobe Premiere Pro version 15.4 (and earlier) are affected by a memory corruption vulnerability. An unauthenticated atta

flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index p

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX

Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie cons

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+.

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+.

Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+.

Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0.

Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.

Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket custome

When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received

There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user wit

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been declared as critical. This vulnerability affects un

A vulnerability was found in Navetti PricePoint 4.6.0.0. It has been classified as problematic. This affects an unknown

A vulnerability was found in Navetti PricePoint 4.6.0.0 and classified as problematic. Affected by this issue is some un

A vulnerability has been found in Navetti PricePoint 4.6.0.0 and classified as critical. Affected by this vulnerability

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown fun

Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By explo

Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated at

Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log

Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a pl

Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthen

Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obt

Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrativ

In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental f

Code Injection in GitHub repository nuitka/nuitka prior to 0.9.

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the D