2025

In the Linux kernel, the following vulnerability has been resolved: drm: bridge: anx7625: Fix NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: smb: client: let recv_done verify data_offset, data

In the Linux kernel, the following vulnerability has been resolved: smb: client: let smbd_destroy() call disable_work_s

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdirect_recv_io leak in smbd_neg

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to R

The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to C

The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site

The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptograph

The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorizedmodification of data due to a missing capa

The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label'

The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPres

The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including,

In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malformed

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all

The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and incl

MacForge contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.Thi

Mastra is a Typescript framework for building AI agents and assistants. Versions 0.13.8 through 0.13.20-alpha.0 are vuln

KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its fi

Minecraft RCON Terminal is a VS Code extension that streamlines Minecraft server management. Versions 0.1.0 through 2.0.

Anyquery is an SQL query engine built on top of SQLite. Versions 0.4.3 and below allow attackers who have already gained

DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. Versions 0.34.1 and belo

Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authent

A vulnerability in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 throug

Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the wa

phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of e

OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does no

Two unauthenticated diagnostic endpoints allow arbitrary backend-initiated network connections to an attacker‑supplied d

The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the S

Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission de

Eidos is an extensible framework for Personal Data Management. Versions 0.21.0 and below contain a one-click remote code

NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when develo

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user

An unquoted search path or element vulnerability has been reported to affect NetBak Replicator. If a local attacker gain

An improper authentication vulnerability has been reported to affect QNAP Authenticator. If an attacker gains physical a

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the

An SQL injection vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system ver

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system ver

An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote