2025

Malicious or unintentional API requests can be used to add significant amount of data to caches. Caches may evict inform

The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on t

The OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) plugin for WordPress is vulnerable to

The Zombify plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.5. This is du

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BA

The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and includi

The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vu

The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file p

cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt

The Noo JobMonster theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.8.

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection i

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. contain an OS command Injection vulnerability. A user

The RealPress WordPress plugin before 1.1.0 registers the REST routes without proper permission checks, allowing the cr

The FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.)

The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all ver

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (o

LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api

Scrapy versions up to 2.13.2 are vulnerable to a denial of service (DoS) attack due to a flaw in its brotli decompressio

A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access applicat

SQL injection in Revive Adserver 6.0.0 causes potential disruption or information access when specifically crafted paylo

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintention

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user.

A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator

In Brave Browser Desktop versions prior to 1.83.10 that have the split view feature enabled, the "Open Link in Split Vie

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker c

Nagios Log Server versions prior to 2024R1.3.2 contain a privilege escalation vulnerability in the account email-change

Nagios XI versions prior to 2024R2 contain an improperly owned script, process_perfdata.pl, which is executed periodical

Nagios XI versions prior to 2026R1 contain a remote code execution vulnerability in the Core Config Manager (CCM) Run C

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validatio

Nagios XI versions prior to 2024R1.4.2 revealed API keys to users who were not authorized for API access when using Nept

Nagios Network Analyzer versions prior to 2024R2.0.1 contain a vulnerability in the LDAP certificate management function

Nagios Network Analyzer versions prior to 2024R1 contain a stored cross-site scripting (XSS) vulnerability in the Source

Nagios Log Server versions prior to 2024R1.3.1 contain a code injection vulnerability where malformed dashboard ID value

Nagios Log Server versions prior to 2024R2.0.3 contain an execution with unnecessary privileges vulnerability as it runs

Nagios Log Server versions prior to 2024R2.0.3 contain an incorrect authorization vulnerability that allows non-administ

In Nagios Log Server versions prior to 2024R2.0.3, when a user's configured default dashboard is deleted, the applicatio

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting

Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the AD/LDAP user import functionality as it fa

Nagios XI versions prior to 2024R1.4.2 configure some systemd unit files with permission sets that were too permissive.

Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligenc

Nagios Log Server versions prior to 2024R1.0.2 contain a local privilege escalation vulnerability that allows an attacke

Nagios XI versions prior to 2024R1.0.1 contain a privilege escalation vulnerability in the System Profile component. The

Nagios XI versions prior to 2024R1.3.2 contain a remote command execution vulnerability in the WinRM Configuration Wizar

Nagios XI versions prior to 2024R1.2.2 contain a host header injection vulnerability. The application trusts the user-su

Nagios XI versions prior to 2024R1.2 contain a command injection vulnerability in the Docker Wizard. Insufficient valida

Nagios XI versions prior to 2024R1.2 contain a privilege escalation vulnerability related to NagVis configuration handli

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data

Nagios XI versions prior to 2024R1.1.4 contain a local file inclusion (LFI) vulnerability via its NagVis integration. An

Nagios XI versions prior to 2024R1.1.3 are vulnerable to cross-site scripting (XSS) via the Executive Summary Report com