2025

The WPRecovery plugin for WordPress is vulnerable to SQL Injection via the 'data[id]' parameter in all versions up to, a

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and

An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may all

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all version

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl

The SiteAlert (Formerly WP Health) plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca

The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' sh

The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back'

The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi A

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSourc

The Spirit Framework plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1

Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center

Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitte

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored

Cursor is a code editor built for programming with AI. In versions 1.6 and below, Mermaid (a to render diagrams) allows

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the sta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

The Yoast SEO Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions 25.7 to 25.9 due to

Volto is a ReactJS-based frontend for the Plone Content Management System. Versions 16.34.0 and below, 17.0.0 through 17

Traccar is an open source GPS tracking system. Default installs of Traccar on Windows between versions 6.1- 6.8.1 and n

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerabil

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open R

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL In

CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with admin

CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the c

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-S

WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability whi

MANTRA is a purpose-built RWA Layer 1 Blockchain, capable of adherence to real world regulatory requirements. Versions 4

CVE-2025-54087 is a server-side request forgery vulnerability in Secure Access prior to version 14.10. Attackers with ad

CVE-2025-54086 is an excess permissions vulnerability in the Warehouse component of Absolute Secure Access prior to vers

An unauthenticated debug port may allow access to the device file system.

LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attac

The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.

The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient

SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.

An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobil

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan f

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuWa

Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck

The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falco

The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow Li

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and S