2025

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON doc

The Telegram Bot & Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Telegram username i

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not align

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capabil

The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can

lunary-ai/lunary version 1.9.34 is vulnerable to an account takeover due to improper authentication in the Google OAuth

Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based tim

Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js appl

OpenBao is an open source identity-based secrets management system. Prior to version 2.4.4, a privileged operator could

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to versio

The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attri

An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary c

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.1

A Directory Traversal vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Ha

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.1

In RSA Authentication Agent before 7.4.7, service paths and shortcut paths may be vulnerable to path interception if the

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, p

Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potenti

Improper return value within AMD uProf can allow a local attacker to bypass KSLR, potentially resulting in loss of confi

IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decry

Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a

Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user s

Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition poten

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) versions

Ruijie NBR series routers contain an unauthenticated arbitrary file upload vulnerability via /ddi/server/fileupload.php.

Shenzhen TVT Digital Technology Co., Ltd. NVMS-9000 firmware (used by many white-labeled DVR/NVR/IPC products) contains

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulner

OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.

An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.

Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, a

A buffer overflow with Xilinx Run Time Environment may allow a local attacker to read or corrupt data from the advanced

Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, p

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.

body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large n

A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint (/MILLENSYS/settings) that is acc

A Cross-Site Request Forgery (CSRF) in the /usapi?method=add-user component of Magewell Pro Convert v1.2.213 allows atta

A Cross-Site Request Forgery (CSRF) in the /mwapi?method=add-user component of Magewell Pro Convert v1.2.213 allows atta

Xtooltech Xtool AnyScan Android Application 4.40.40 is Missing Authentication for Critical Function. The server-side end

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downl

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior uses a hardcoded cryptographic key and IV to decrypt updat

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fai

A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Insti