2025

Bio.Entrez in Biopython through 186 allows doctype XXE.

Information disclosure while processing system calls with invalid parameters.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-

A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function o

A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/sitecon

A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /c

Serendipity 2.4.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicio

Revive Adserver 5.4.1 contains a cross-site scripting vulnerability in the banner advanced configuration page that allow

PHPFusion 9.10.30 contains a stored cross-site scripting vulnerability in the file manager that allows attackers to uplo

PHPJabbers Simple CMS 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to in

UliCMS 2023.1 contains a stored cross-site scripting vulnerability that allows attackers to upload malicious SVG files w

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible throug

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the Freebox content field accessible thro

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible throug

Affiliate Me version 5.0.1 contains a SQL injection vulnerability in the admin.php endpoint that allows authenticated ad

Zenphoto 1.6 contains a stored cross-site scripting vulnerability in the user postal code field accessible through the a

Zenphoto 1.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject maliciou

USB Flash Drives Control 4.1.0.0 contains an unquoted service path vulnerability in its service configuration that allow

Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows auth

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

WBCE CMS 1.6.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malici

Bludit versions before 3.13.1 contain an authenticated file download vulnerability in the Backup Plugin that allows logg

projectSend r1605 contains a stored cross-site scripting vulnerability that allows authenticated administrators to injec

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject m

ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/

ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting

ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnera

Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the a

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat

ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in Church

ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to

Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a use

An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and fi

An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users

Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lo

This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS T

A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4,

The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iP

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3,

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and i

The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the

Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to t