2025

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox i

The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL

The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Re

The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1. Th

The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in a

User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal an

Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZi

A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of

A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from a

MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service

HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 thr

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a spec

The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, a

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versio

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to u

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path val

The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-9 and 6.9.

Vim is an open source, command line text editor. Prior to version 9.1.1947, an uncontrolled search path vulnerability on

Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuic

FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username

NMIS/BioDose software V22.02 and previous versions contain executable binaries with plain text hard-coded passwords. The

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which

NMIS/BioDose V22.02 and previous version installations where the embedded Microsoft SQLServer Express is used are expose

NMIS/BioDose V22.02 and previous versions rely on a Microsoft SQL Server database. The SQL user account 'nmdbuser' and o

NMIS/BioDose V22.02 and previous versions rely on a common SQL Server user account to access data in the database. User

Lvzhou CMS before commit c4ea0eb9cab5f6739b2c87e77d9ef304017ed615 (2025-09-22) is vulnerable to SQL injection via the 't

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the /admin/password-recovery.php endpoint. Specifically,

A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed e

The DesignThemes LMS plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authenticatio

The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call eac

Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a har

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to versi

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Prior to 1.24.0, The M

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.1, 5.4.3, 5.3.4, 5.2.6, 5.1.6, and earli

SQL injection vulnerability in long2ice assyncmy thru 0.2.10 allows attackers to execute arbitrary SQL commands via craf

Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be p

code-projects Online Medicine Guide 1.0 is vulnerable to SQL Injection in /login.php via the upass parameter.

A container privilege escalation flaw was found in certain CodeReady Workspaces images. This issue stems from the /etc/p