2025

A vulnerability was found in ZenTao up to 21.7.6-8564. This affects the function makeRequest of the file module/ai/model

A vulnerability has been found in Chanjet CRM up to 20251106. The impacted element is an unknown function of the file /t

A flaw has been found in ZenTao up to 21.7.6-8564. The affected element is the function file::delete of the file module/

A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fe

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects so

A weakness has been identified in yungifez Skuul School Management System up to 2.6.5. This vulnerability affects unknow

A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the fun

HTCondor Access Point before 25.3.1 allows an authenticated user to impersonate other users on the local machine by subm

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date.

A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40

Tryton trytond 6.0 before 7.6.11 does not enforce access rights for the route of the HTML editor. This is fixed in 7.6.1

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is

Tryton sao (aka tryton-sao) before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.

Tryton sao (aka tryton-sao) before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and

The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and includin

A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment r

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitm

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not i

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflo

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains a

Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execut

Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data.

OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not exp

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows p

AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQ

AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been ident

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.

Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a sh

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of rol

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could caus

willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a comm

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-sid

Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cro

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttool

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerabil

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerabi

PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubN

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affec

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service

Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v

File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.

CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.

Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.