2025

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The serv

The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in th

perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to exec

R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the sys

Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that all

Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save en

WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticate

dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Se

A vulnerability has been identified in Genexis Platinum P4410 router (Firmware P4410-V2–1.41) that allows a local networ

The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a

Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the theme parameter.

ALLNET ALL-RUT22GW v3.3.8 was discovered to contain an OS command injection vulnerability via the command parameter in t

ALLNET ALL-RUT22GW v3.3.8 was discovered to store hardcoded credentials in the libicos.so library.

Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with

Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext

Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint

Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an

There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.

auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line pa

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions bef

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the

A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /gof

A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.p

Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded conten

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V

A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of

A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Co

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules

Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper me

Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.00

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users

A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tas

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authentic

Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti

Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i

Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive

Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via th

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology Bee

Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attack

Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-139

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memo

In the Linux kernel, the following vulnerability has been resolved: vfat: fix missing sb_min_blocksize() return value c

In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_inser