2025

The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers wi

NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An a

A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' a

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Atta

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause

Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for

Dify v1.6.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component controllers.console.remote_

A security flaw in the '_transfer' function of a smart contract implementation for Money Making Opportunity (MMO), an Et

There is a memory corruption vulnerability due to an out of bounds read in DefaultFontOptions() when using SymbolEditor

There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in N

TitanSystems Zender v3.9.7 contains an account takeover vulnerability in its password reset functionality. A temporary p

An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper hand

SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category

An improper access control vulnerability in FormCms v0.5.4 in the /api/schemas/history/[schemaId] endpoint allows unauth

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method.

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class.

Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True

A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE

A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/pas

An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowi

A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Re

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_p

Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an ou

In Frappe ERPNext 15.57.5, the function get_loyalty_program_details_with_points() at erpnext/accounts/doctype/loyalty_pr

In Frappe ErpNext v15.57.5, the function get_timesheet_detail_rate() at erpnext/projects/doctype/timesheet/timesheet.py

In Frappe ErpNext v15.57.5, the function get_income_account() at erpnext/controllers/queries.py is vulnerable to SQL Inj

In Frappe ERPNext v15.57.5, the function import_coa() at erpnext/accounts/doctype/chart_of_accounts_importer/chart_of_ac

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) contain an undocumente

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.

Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.

Cookie storage for non-HTML temporary documents was being shared incorrectly with normal browsing content, allowing info

A vulnerability exists in Asset Suite for an authenticated user to manipulate the content of performance related log dat

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,

The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

The Chat by Chatwee plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includin

The LockerPress – WordPress Security Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all vers

The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-

The Post By Email plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in

The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all ver

The Copypress Rest API plugin for WordPress is vulnerable to Remote Code Execution via copyreap_handle_image() Function

The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in

The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedm

The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blo

The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the