2025

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification

The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all vers

EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attemp

The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & Aut

Claude Code is an agentic coding tool. Prior to version 2.0.31, due to an error in sed command parsing, it was possible

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Z

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, the /v1/c

vLLM is an inference and serving engine for large language models (LLMs). From version 0.5.5 to before 0.11.1, users can

vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memor

A security flaw has been discovered in itsourcecode Online File Management System 1.0. This issue affects some unknown p

Improper access control in GitHub Copilot and Visual Studio Code allows an authorized attacker to execute code over a ne

Improper authorization in Dynamics OmniChannel SDK Storage Containers allows an unauthorized attacker to elevate privile

Microsoft Defender Portal Spoofing Vulnerability

Azure Monitor Elevation of Privilege Vulnerability

Microsoft SharePoint Online Elevation of Privilege Vulnerability

Azure Bastion Elevation of Privilege Vulnerability

IBM webMethods Integration 10.11 through 10.11_Core_Fix22, 10.15 through 10.15_Core_Fix22, and 11.1 through 11.1_Core_Fi

A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This vulnerability affe

Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory.

IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in

IBM Concert 1.0.0 through 2.0.0 could allow a local user to forge log files to impersonate other users or hide their ide

IBM Concert 1.0.0 through 2.0.0 could allow a local user with specific permission to obtain sensitive information from f

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated atta

A vulnerability exists in the Opto22 Groov Manage REST API on GRV-EPIC and groov RIO Products that allows remote code ex

The affected products allow unauthenticated access to Open Network Video Interface Forum (ONVIF) services, which may all

An issue was discovered in weijiang1994 university-bbs (aka Blogin) in commit 9e06bab430bfc729f27b4284ba7570db3b11ce84 (

Quark Cloud Drive v3.23.2 has a DLL Hijacking vulnerability. This vulnerability stems from the insecure loading of syste

The affected product allows unauthenticated access to Real Time Streaming Protocol (RTSP) services, which may allow an a

FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script.

Improper neutralization of input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes manager accounts to be a

Debug information disclosure in the SQL error message to in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete

Insecure design policies in the user management system of Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes no

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier version

Missing JSON Content-Type header in a script in Revive Adserver 6.0.1 and 5.5.2 and earlier versions causes a stored XSS

Improper neutralisation of format characters in the settings of Revive Adserver 5.5.2 and 6.0.1 and earlier versions cau

Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XS

Authorization bypass in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes an logged in attacker to change othe

Medical Informatics Engineering Enterprise Health has a stored cross site scripting vulnerability that allows an authent

HackerOne community member Dang Hung Vi (vidang04) has reported an uncontrolled resource consumption vulnerability in th

HackerOne community member Dao Hoang Anh (yoyomiski) has reported an improper neutralization of whitespace in the userna

HackerOne community member Dang Hung Vi (vidang04) has reported a stored XSS vulnerability involving the navigation box

Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects AB

cups-filters contains backends, filters, and other software required to get the cups printing service working on operati

The fetch function in file thinkphp\library\think\Template.php in ThinkPHP 5.0.24 allows attackers to read arbitrary fil

The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code exec