2025

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 does not implement access control for th

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to adjust Drive

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 provides the functionality of returning

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the st

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows a remote authenticated attacker t

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has a Global Store Directory that shares

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 transmits passwords of user accounts in

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 has an "Anyone Can Join This Party" sign

pyquokka is a framework for making data lakes work for time series. In versions 0.3.1 and prior, the FlightServer class

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulne

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this issue is the function

yt-grabber-tui is a C++ terminal user interface application for downloading YouTube content. yt-grabber-tui version 1.0

Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially all

A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is

A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file

A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of t

A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the funct

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-

CobbleStone Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) in its cha

A SQL injection vulnerability in the content_title parameter of the /cms/content/list endpoint in MCMS 5.5.0 allows remo

A lack of rate limiting in the login mechanism of SigningHub v8.6.8 allows attackers to bypass authentication via a brut

An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a c

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload

ThingsBoard in versions prior to v4.2.1 allows an authenticated user to upload malicious SVG images via the "Image Galle

A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the functi

A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the f

XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (us

ClipBucket v5 is an open source video sharing platform. ClipBucket v5 through build 5.5.2 #145 allows stored cross-site

ClipBucket is a web-based video-sharing platform. In ClipBucket version 5.5.2 - #146 and earlier, the /admin_area/templa

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datas

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a stored cross-site scrip

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vuln

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vuln

Tillywork v0.1.3 and below is vulnerable to SQL Injection in app/common/helpers/query.builder.helper.ts.

Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase

ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credential

Due to improper input validation, a buffer overflow vulnerability is present in Zigbee EZSP Host Applications. If the

A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local f

A path traversal vulnerability in all versions of the Windsurf IDE enables a threat actor to read and write arbitrary lo

A server-side request forgery (SSRF) vulnerability in Illia Cloud illia-Builder before v4.8.5 allows authenticated users

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects aft

Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable t

A remote code execution (RCE) vulnerability exists in the PluXml CMS theme editor, specifically in the minify.php file l

Deserialization of untrusted data can occur in versions of the Keras framework running versions 3.11.0 up to but not inc

Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git re