2025

A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Insti

An issue in the size query parameter (/views/file.py) of Austrian Archaeological Institute Openatlas before v8.12.0 allo

Incorrect access control in Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to access sensit

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_Subs

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST

An issue in Austrian Academy of Sciences (AW) Austrian Archaeological Institute OpenAtlas v.8.12.0 allows a remote attac

ZIRA Group WBRM 7.0 is vulnerable to SQL Injection in referenceLookupsByTableNameAndColumnName.

A firmware downgrade vulnerability exists in the OTA Update functionality of GL-Inet GL-AXT1800 4.7.0. A specially craft

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set

A stored Cross-site Scripting (XSS) vulnerability affecting Service Items Management in DELMIA Service Process Engineer

A stored Cross-site Scripting (XSS) vulnerability affecting Requirements in ENOVIA Product Manager from Release 3DEXPERI

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins contain a flaw in the tag_key validation logic that fa

Fluent Bit in_http, in_splunk, and in_elasticsearch input plugins fail to sanitize tag_key inputs. An attacker with netw

Fluent Bit out_file plugin does not properly sanitize tag values when deriving output file names. When the File option i

The extract_name function in Fluent Bit in_docker input plugin copies container names into a fixed size stack buffer wit

Fluent Bit in_forward input plugin does not properly enforce the security.users authentication mechanism under certain c

iStats contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via c

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though

Use after free in endpoint destructors in Redboltz async_mqtt 10.2.5 allows local users to cause a denial of service via

Null pointer dereference in add_ca_certs() in Cesanta Mongoose before 7.2 allows remote attackers to cause a denial of s

Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of

NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack

Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause

NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack

NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack

NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attack

Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers t

NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attacker

NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of servic

Inadequate access control vulnerability in Davantis DDFUSION v6.177.7, which allows unauthorised actors to retrieve pers

Inadequate access control vulnerability in Davantis DFUSION v6.177.7, which allows unauthorised actors to extract images

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix refcount leak in nfsd_set_fh_dentry() nf

The WP 2FA WordPress plugin does not generate backup codes with enough entropy, which could allow attackers to bypass th

An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denia

Cross-Site Scripting (XSS) vulnerability stored in tha Taclia web application, where the uploaded SVG images are not pro

A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, ca

A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML,

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would exe

A sensitive information disclosure vulnerability exists in the error handling component of ATISoluciones CIGES Applicati

A vulnerability was found in lKinderBueno Streamity Xtream IPTV Player up to 2.8. The impacted element is an unknown fun

A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file

A vulnerability was detected in itsourcecode COVID Tracking System 1.0. This issue affects some unknown processing of th

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it bac

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before

The Backup Migration WordPress plugin before 2.0.0 does not properly generate its backup path in certain server configur

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputtin

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to time-based SQL In

A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the com

A weakness has been identified in code-projects Question Paper Generator 1.0. This affects an unknown part of the file /