2025

The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticate

The WP Hotel Booking WordPress plugin before 2.2.3 lacks proper server-side validation for review ratings, allowing an a

The Password Reset with Code for WordPress REST API WordPress plugin before 0.0.17 does not use cryptographically sound

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker c

Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability a

Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remo

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and

jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs

Dyad is a local AI app builder. A critical security vulnerability has been discovered that affected Dyad v0.19.0 and ear

A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READ_PLUS (aga

In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap o

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix race in lowcomms This patch fixes a r

In the Linux kernel, the following vulnerability has been resolved: skmsg: pass gfp argument to alloc_sk_msg() syzbot

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default pass

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics

An Improper Handling of Exceptional Conditions vulnerability in the ZIP archive scanning component of mmaitre314 pickles

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attac

Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability,

Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability

A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with va

SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file up

Ilevia EVE X1/X5 Server version ≤ 4.7.18.0.eden contains a vulnerability in its authentication mechanism. Unsanitized in

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax

An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Mat

Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not v

A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between l

Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification. An application shoul

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 200 - Exposure of Sensitive

An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php comp

If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Cont

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potent

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot a

Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalat

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BGS Interactive SI

The issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26. An

A logic issue was addressed with improved state management. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, t

The issue was addressed with improved memory handling. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tah

A correctness issue was addressed with improved checks. This issue is fixed in Safari 26, iOS 18.7 and iPadOS 18.7, iOS

An authorization issue was addressed with improved state management. This issue is fixed in iOS 26 and iPadOS 26, macOS

An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data sou

An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and p

Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch intr

TOTOLINK X6000R V9.4.0cu.1360_B20241207 was found to contain a command injection vulnerability in the sub_417D74 functio

In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized