2024

The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up

In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to exec

Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a craft

Discourse is an open-source discussion platform. Improperly sanitized user input could lead to an XSS vulnerability in s

Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap

Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap

Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially expl

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Vyper compiler allows passing a value in b

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tans

An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion

urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable t

apollo-client-nextjs is the Apollo Client support for the Next.js App Router. The @apollo/experimental-apollo-client-nex

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

A vulnerability was found in openBI up to 1.0.8 and classified as critical. This issue affects the function uploadIcon o

CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. Th

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a ta

TrueLayer.NET is the .Net client for TrueLayer. The vulnerability could potentially allow a malicious actor to gain con

TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL

Authentik is an open-source Identity Provider. There is a bug in our implementation of PKCE that allows an attacker to c

A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography St

In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when

In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files.

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Mul

A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function

ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially

HCL BigFix ServiceNow is vulnerable to arbitrary code injection. A malicious authorized attacker could inject arbitrary

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc paramet

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url paramete

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enab

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass pa

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable pa

TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable param

TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.

A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadFile

A flaw was found in the Linux kernel's memory deduplication mechanism. The max page sharing of Kernel Samepage Merging (

A vulnerability, which was classified as problematic, has been found in openBI up to 1.0.8. Affected by this issue is th

A vulnerability classified as critical was found in openBI up to 1.0.8. Affected by this vulnerability is the function t

A vulnerability was found in CodeAstro Expense Management System 1.0. It has been declared as problematic. This vulnerab

Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version , which allows a lo

Vulnerability of improper checking for unusual or exceptional conditions in Lamassu Bitcoin ATM Douro machines, in its

Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines, in its 7.1 version, which could allow a local

An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novel

Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an