2025

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, macOS Sequoia 15.

A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS

A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay

A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS

This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to gain root

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4,

The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app

Online Shopping System Advanced 1.0 contains a SQL injection vulnerability in the payment_success.php script that allows

The Preset configuration https://v2.vuetifyjs.com/en/features/presets  feature of Vuetify is vulnerable to Prototype P

A weakness has been identified in itsourcecode Student Management System 1.0. The affected element is an unknown functio

A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAut

Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perfor

Atcom 100M IP Phones firmware version 2.7.x.x contains an authenticated command injection vulnerability in the web confi

WonderCMS 4.3.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious JavaScript throu

A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some u

A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unkn

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craf

An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overw

A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The

A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affec

BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via

APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privile

Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for enc

SolarEdge SE3680H  ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attac

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allo

The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any a

Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract:

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization wi

A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uni

Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Expr

The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injec

Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algor

The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all

Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously

gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. Wh

Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0

The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including,

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a mi

The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and

The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including,

The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1

Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.

It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a den

MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow

MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to

WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrator

xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative pr

xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system

CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authent