2025

CWE-1392: Use of Default Credentials

CWE-1242: Inclusion of Undocumented Features

Use of Default Cryptographic Key (CWE-1394)

Multiple CWE-78

Tenda W30E V16.01.0.19 (5037) was discovered to contain a stack overflow in the v17 parameter in the UploadCfg function.

Cross-Site Request Forgery (CSRF) vulnerability in Frenify Mow mow allows Code Injection.This issue affects Mow: from n/

Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to ex

ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restr

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommer

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.T

A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthent

The Amp’ed RF BT-AP 111 Bluetooth access point's HTTP admin interface does not have an authentication feature, allowing

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an

A vulnerability has been identified in SIMATIC Virtualization as a Service (SIVaaS) (All versions). The affected applica

A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to arbitrary file deletion due to insuffi

Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high priv

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through th

SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available servic

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashbo

WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary

The Doccure theme for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.5.0.

The Doccure Core plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

codeceptjs 3.7.3 contains a command injection vulnerability in the emptyFolder function (lib/utils.js). The execSync com

A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitr

A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplyin

rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc.

Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vu

OPSI before 4.3 allows any client to retrieve any ProductPropertyState, including those of other clients. This can lead

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below conta

The AdForest theme for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 6.0.9. Thi

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.26.6 and below, a Github w

In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ism_cmd()

In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag R

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time T

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_

In the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uninitialised variable Fix s

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() B

PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use default, shared credentials for the administrative

PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav Mirac

Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue af

Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allow

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI ver

Azure Bot Service Elevation of Privilege Vulnerability

Azure Entra ID Elevation of Privilege Vulnerability

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 thro

Azure Networking Elevation of Privilege Vulnerability