2025

Plane is open-source project management software. Versions prior to 0.23 have insecure permissions in UserSerializer tha

GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3,

A vulnerability was found in Ackites KillWxapkg up to 2.4.1. It has been rated as problematic. This issue affects some u

Missing Authorization vulnerability in Drupal Single Content Sync allows Functionality Misuse.This issue affects Single

A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown co

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of

A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability i

A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. Thi

A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some

Failed login response could be different depending on whether the username was local or central.

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS an

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software.

A logic issue was addressed with improved checks. This issue is fixed in iOS 18.3 and iPadOS 18.3. Photos in the Hidden

Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This

In Node.js, the `ReadFileUtf8` internal binding leaks memory due to a corrupted pointer in `uv_fs_s.file`: a UTF-16 path

A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391

O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS (IP Multim

A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an u

A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue af

A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulne

A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue

A vulnerability has been found in itwanger paicoding 1.0.0/1.0.1/1.0.2/1.0.3 and classified as problematic. Affected by

A vulnerability classified as problematic has been found in y_project RuoYi 4.8.0. Affected is an unknown function of th

libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib

CVE-2024-38820 ensured Locale-independent, lowercase conversion for both the configured disallowedFields patterns and fo

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 29.0.13, 30.0.7, and 31.0.1 and Ne

A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affect

A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affect

A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.as

The Simple Job Board WordPress plugin before 2.12.6 does not prevent uploaded files from being listed, allowing unauthen

The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which

The Responsive Gallery Grid WordPress plugin before 2.3.15 does not sanitise and escape some of its settings, which coul

The Advanced Cron Manager WordPress plugin before 2.5.7 does not sanitise and escape some of its settings, which could

The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.6.9 does not sanitise and escape some of its set

The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow

The buddyboss-platform WordPress plugin before 2.7.60 lacks proper access controls and allows a logged-in user to view c

The Real WP Shop Lite Ajax eCommerce Shopping Cart WordPress plugin through 2.0.8 does not sanitise and escape some of i

The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing

The TwitterPosts WordPress plugin through 1.0.2 does not have CSRF check in place when updating its settings, which coul

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to i

Mattermost versions 10.5.x <= 10.5.3, 9.11.x <= 9.11.11 fail to check `RestrictSystemAdmin` setting if user doesn't have

Information Exposure vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue a

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a

Incorrect execution-assigned permissions for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow

Improper conditions check for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an authenticat

Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an aut

Uncontrolled resource consumption for some Edge Orchestrator software for Intel(R) Tiber™ Edge Platform may allow an aut