2025

Tinxy WiFi Lock Controller v1 RF was discovered to transmit sensitive information in plaintext, including control inform

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.4, macOS S

A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequo

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 1

A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the functio

A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of t

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as cr

A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is v

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.

Dell ThinOS 2502 and prior contain a Cleartext Storage of Sensitive Information vulnerability. A high privileged attacke

Buffer Overflow vulnerability in Free5gc v.4.0.0 allows a remote attacker to cause a denial of service via the AMF, NGAP

An issue in Open Network Foundation ONOS v2.7.0 allows attackers to cause a Denial of Service (DoS) via supplying crafte

vLLM is an inference and serving engine for large language models (LLMs). In versions starting from 0.7.0 to before 0.9.

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation fro

Mattermost versions 10.7.x <= 10.7.0, 10.6.x <= 10.6.2, 10.5.x <= 10.5.3, 9.11.x <= 9.11.12 fail to properly validate pe

A vulnerability classified as critical was found in aimhubio aim up to 3.29.1. This vulnerability affects the function R

yasm commit 9defefae was discovered to contain a NULL pointer dereference via the yasm_section_bcs_append function at se

HuoCMS V3.5.1 has a File Upload Vulnerability. An attacker can exploit this flaw to bypass whitelist restrictions and cr

HuoCMS V3.5.1 and before is vulnerable to file upload, which allows attackers to take control of the target server

In the Linux kernel, the following vulnerability has been resolved: fs/erofs/fileio: call erofs_onlinefolio_split() aft

In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for modul

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer acc

In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_class_allocate_dev(): initialize

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exp

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insuffi

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ pa

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all v

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a st

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to Externa

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site S

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to ver

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability

Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incor

Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1,

Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsa

An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x

An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.10

Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unautho

SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. T

SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vul

SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by u

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token