2024

TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the

The Video PopUp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'video_popup' shortcode in version

The WCFM Marketplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'wcfm_stores' shortcode in ve

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in version

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Th

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Th

The GiveWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.33.3. Th

ManageEngine ADSelfService Plus versions 6401 and below are vulnerable to the remote code execution due to the improper

SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstr

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in

The WP 2FA – Two-factor authentication for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Refere

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all v

The LearnPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includi

Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and servi

Authentik is an open-source Identity Provider. Authentik is a vulnerable to a reflected Cross-Site Scripting vulnerabili

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in al

The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up t

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python synt

cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to gen

member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.

An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to cause

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the pmsvcs kernel e

IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security V

Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language param

GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel e

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the NFS kernel exte

pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An

The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, perso

ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitr

Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port o

Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port

An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network proto

Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azu

Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged

An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted PO

quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, RFC 9002) in Go. An attacker can cause its peer t

The issue was addressed with improved checks. This issue is fixed in iOS 17.2 and iPadOS 17.2. An attacker in a privileg

An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sonoma 14, i

This issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to gain elevat

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. An app may be able to access prote

The issue was addressed with improved bounds checks. This issue is fixed in macOS Sonoma 14. Processing a file may lead

The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17

The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14, iOS 17 and iPadOS 17. An