2025

The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inclu

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vuln

fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetratio

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode d

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set o

LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, t

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and th

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18

During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\window

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disc

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in i

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication

A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to

A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker t

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused b

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused b

In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module direc

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending sp

A vulnerability has been found in Dahua products. Attackers could exploit a buffer overflow vulnerability by sending sp

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics Magi

Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samsung Electronics Magi

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Inje

Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Ser

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Inje

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Inje

All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the

All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provid

Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record

The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within

A vulnerability has been found in Tenda AC23 16.03.07.52 and classified as critical. Affected by this vulnerability is t

A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. T

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corr

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corr

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network d

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and

pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated pat

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of netwo

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were dis

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option i

DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted b

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

DuraComm SPM-500 DP-10iN-100-MU lacks access controls for a function that should require user authentication. This cou

DuraComm SPM-500 DP-10iN-100-MU is vulnerable to a cross-site scripting attack. This could allow an attacker to preven

Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these b