2025

In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_

The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and includin

The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability che

Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the

HCL BigFix Mobile 3.3 and earlier is affected by improper access control. Unauthorized users can access a small subset

The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to

HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control. Unauthorized users ca

The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version

ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability

YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential info

go-witness and witness are Go modules for generating attestations. In go-witness versions 0.8.6 and earlier and witness

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,

A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.6 and iPadOS 18.6, iPad

The issue was addressed with improved authentication. This issue is fixed in macOS Sequoia 15.6. A local attacker may be

The issue was resolved by not loading remote images. This issue is fixed in iOS 18.6 and iPadOS 18.6. Forwarding an emai

Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers 

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption for

Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Tech

In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating unt

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Prior to 0.16.2, Frigate'

sveltekit-superforms makes SvelteKit forms a pleasure to use. sveltekit-superforms v2.27.3 and prior are susceptible to

OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSe

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions thr

CommandKit is the discord.js meta-framework for building Discord bots. In versions 1.2.0-rc.1 through 1.2.0-rc.11, a log

Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a dis

Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of informatio

Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Conditio

Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated,

Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated,

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phon

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phon

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software cou

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace e

Alloy Core libraries at the root of the Rust Ethereum ecosystem. Prior to 0.8.26 and 1.4.1, an uncaught panic triggered

When using a multi-bladed platform with more than one blade, undisclosed traffic can cause the Traffic Management Microk

When a BIG IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker

Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.128.Final and 4.2.7.Final

When IPsec is configured on the BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to

A vulnerability exists in F5OS-A and F5OS-C system that may allow an authenticated attacker with local access to escalat

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIP

Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if the application u

A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver that could allow a

A potential vulnerability was reported in PC Manager that could allow a local authenticated user to execute code with el

An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could all