2024

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' paramete

iDRAC9, versions prior to 7.00.00.172 for 14th Generation and 7.10.50.00 for 15th and 16th Generations, contains a sessi

The Goya theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attra-color’, 'attra-size', and '

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Store

The Stock Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock_ticker shortco

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ attribute

The Extensions for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter w

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress plugin for

The Page and Post Clone plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, an

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site S

The Advanced File Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an

The Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels, Order Bumps

The Floating Social Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

parseWildcardRules in Gin-Gonic CORS middleware before 1.6.0 mishandles a wildcard at the end of an origin string, e.g.,

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling

R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. This was fixed in a hotfix to

ZKsync Era is a layer 2 rollup that uses zero-knowledge proofs to scale Ethereum. There is possible invalid stack access

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cry

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malforme

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS

Kavita is a cross platform reading server. Opening an ebook with malicious scripts inside leads to code execution inside

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Q

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can injec

A Cross-Site Request Forgery (CSRF) vulnerability was identified in the stitionai/devika application, affecting the late

In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins.

nptd-rs is a tool for synchronizing your computer's clock, implementing the NTP and NTS protocols. There is a missing li

NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lac

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 agent username and password error response discrepancy exp

IBM MQ 9.3 LTS and 9.3 CD could allow a remote attacker to obtain sensitive information when a detailed technical error

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error app

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name

Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is vulnerable to improper certif

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, and 12.0.2 is potentially vulnerable to cro

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allo

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Software Suite 1.10.12.0 through 1.10.21.0 a

A potential Time-of-Check to Time-of Use (TOCTOU) vulnerability has been identified in the HP BIOS for certain HP PC pro

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, valida

authentik is an open-source Identity Provider. Access restrictions assigned to an application were not checked when usin

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token me

IBM MQ Console 9.3 LTS and 9.3 CD could disclose could allow a remote attacker to obtain sensitive information when a de

IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS and 9.3 CD, in certain configurations, is vulnerable to a denial of service at

IBM MQ 9.3 LTS and 9.3 CD could allow an authenticated user to escalate their privileges under certain configurations du

A vulnerability, which was classified as critical, has been found in Tenda A301 15.13.08.12. Affected by this issue is t

A vulnerability classified as critical was found in Tenda A301 15.13.08.12. Affected by this vulnerability is the functi

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy ap

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information fr