2025

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 f

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 f

The FreePBX Endpoint Manager module includes a Network Scanning feature that provides web-based access to nmap functiona

A prompt injection vulnerability exists in Windsurft version 1.10.7 in Write mode using SWE-1 model. It is possible to

A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the a

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions thr

Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 t

A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP

A denial-of-service security issue exists in the affected product and version. The security issue stems from a high numb

A denial-of-service security issue in the affected product. The security issue stems from a fault occurring when a craft

A security issue was discovered within FactoryTalk® ViewPoint, allowing unauthenticated attackers to achieve XXE. Certai

A security issue exists within the Studio 5000 Logix Designer add-on profile (AOP) for the ArmorStart Classic distribute

gpp-burgerportaal is a Dutch government citizen portal application. In versions before 2.0.3, 3.0.2, and 4.0.1, the name

Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unex

A null pointer dereference has been identified in the AsIO3.sys driver. The vulnerability can be triggered by a speciall

A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipu

Cross-site scripting vulnerability in QGIS QWC2 Registration GUI <=v2025.03.31 allows an authorized attacker to plant ar

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant ar

A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggere

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user ver

Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-i

External Secrets Operator reads information from a third-party service and automatically injects the values as Kubernete

Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulne

Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Happy DOM v19 and lower

HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl

Incorrect Authorization vulnerability in ash-project ash allows Authentication Bypass. This vulnerability is associated

Reflected Cross-Site Scripting (XSS) in Xibo CMS v4.1.2 from Xibo Signage, due to a lack of proper validation of user in

Stored Cross-Site Scripting (XSS) in Xibo Signage's Xibo CMS v4.1.2, due to a lack of proper validation of user input. T

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platfor

ServiceNow has addressed a reflected cross-site scripting vulnerability that was identified in the ServiceNow AI Platfor

Better Auth is an authentication and authorization library for TypeScript. In versions prior to 1.3.26, unauthenticated

Allstar is a GitHub App to set and enforce security policies. In versions prior to 4.5, a vulnerability in Allstar’s Rev

Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, t

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing

D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability within /api/web/dnc/globa

AVTECH devices that include the CloudSetup.cgi management endpoint are vulnerable to authenticated OS command injection.

NetSarang Xmanager Enterprise 5.0 Build 1232, Xmanager 5.0 Build 1045, Xshell 5.0 Build 1322, Xftp 5.0 Build 1218, and X

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privileg

Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script.

CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 (32-bit builds) contained a malicious pre-entry-point loader that dive

Server-Side Request Forgery (SSRF) in the Remote Browser Plugin in Sonatype Nexus Repository 2.x up to and including 2.1

In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable pub

Synapse is an open source Matrix homeserver implementation. Lack of validation for device keys in Synapse before 1.138.3

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform

Vulnerability in the melis-core module of Melis Technology's Melis Platform, which, if exploited, allows an unauthentica

SQL injection vulnerability based on the melis-cms module of the Melis platform from Melis Technology. This vulnerabilit

A potential security vulnerability has been identified in HP Sure Start’s protection of the Intel Flash Descriptor in ce

Insecure Direct Object Reference (IDOR) in Negotiator v3.15.2 from Biobanking and Biomolecular Resources - European Rese

Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infras

Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU