2024

Missing Authorization vulnerability in Vektor,Inc. VK Block Patterns.This issue affects VK Block Patterns: from n/a thro

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up

Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the nu

Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing e

Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error mes

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Calendly widget

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure

Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : fr

Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: fr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EkoJR Advanced Pos

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AccessAlly PopupAl

Cross-Site Request Forgery (CSRF) vulnerability in Brijesh Kothari Smart Maintenance Mode.This issue affects Smart Maint

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annua

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.0 does not validate and escape some of its sh

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL stat

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation a

The Bannerlid WordPress plugin through 1.1.0 does not escape generated URLs before outputting them in attributes, leadin

The Call Now Button WordPress plugin before 1.4.7 does not sanitise and escape some of its settings, which could allow

The WP Chat App WordPress plugin before 3.6.4 does not sanitise and escape some of its settings, which could allow high

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a

The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could a

The Salon booking system WordPress plugin through 9.6.5 does not have CSRF check in place when updating its settings, wh

The WP Google Review Slider WordPress plugin before 13.6 does not sanitise and escape some of its settings, which could

The Social Sharing Plugin WordPress plugin before 3.3.61 does not validate and escape some of its shortcode attributes

The Fancy Product Designer WordPress plugin before 6.1.8 does not sanitise and escape a parameter before outputting it b

Server-Side Template Injection (SSTI) vulnerability in inducer relate before v.2024.1, allows remote attackers to execut

An issue was discovered in PnpSmm in Insyde InsydeH2O with kernel 5.0 through 5.6. There is a possible out-of-bounds acc

Passbolt API before 4.6.2 allows HTML injection in a URL parameter, resulting in custom content being displayed when a u

An issue was discovered in Passbolt Browser Extension before 4.6.2. It can send multiple requests to HaveIBeenPwned whil

An issue was discovered in Zammad before 6.3.0. An authenticated agent could perform a remote Denial of Service attack b

angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. NOTE: the vendor

In deletefiles in FDUPES before 2.2.0, a TOCTOU race condition allows arbitrary file deletion via a symlink.

python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a cra

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-

ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SM

The Advanced Search WordPress plugin through 1.1.6 does not properly escape parameters appended to an SQL query, making

File Upload vulnerability in the function for employees to upload avatars in Code-Projects Simple School Management Syst

An issue discovered in Yealink VP59 Teams Editions with firmware version 91.15.0.118 allows a physically proximate attac

A flaw was found when using mirror-registry to install Quay. It uses a default database secret key, which is stored in p

A flaw was found in Bombastic, which allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endp

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `s

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Prior to version 0.3.0, default functions

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `c

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the `s

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, incorrect va

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds hav

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to ver

MeterSphere is an open source continuous testing platform. Prior to version 2.10.14-lts, members without space permissio