2025

Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03

Tronclass developed by WisdomGarden has an Insecure Direct object Reference vulnerability, allowing remote attackers wit

Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One c

The Keras Model.load_model method can be exploited to achieve arbitrary code execution, even with safe_mode=True. One c

The Embed PDF for WPForms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validati

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry

Unsafe handling in bt_conn_tx_processor causes a use-after-free, resulting in a write-before-zero. The written 4 bytes a

The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versi

Parameters are not validated or sanitized, and are later used in various internal operations.

The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, w

A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specif

The Service Finder SMS System plugin for WordPress is vulnerable to authentication bypass in all versions up to, and inc

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter i

The Kubio AI Page Builder plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capabi

In the @digitalocean/do-markdownit package through 1.16.1 (in npm), the callout and fence_environment plugins perform .i

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can upda

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.

In Internet2 Grouper 5.17.1 before 5.20.5, group admins who are not Grouper sysadmins can configure loader jobs.

Snipe-IT before 8.1.18 allows unsafe deserialization.

Snipe-IT before 8.1.18 allows XSS.

The Goza - Nonprofit Charity WordPress Theme theme for WordPress is vulnerable to unauthorized arbitrary file uploads du

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can up

OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens t

PureVPN client applications on Linux through September 2025 mishandle firewalling. They flush the system's existing ipta

PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon netwo

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Compon

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 in order to allow manage

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform manage

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a proprietary protocol on TCP port 1069 to perform manage

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management ope

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a service implementing a proprietary protocol on TCP port

Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management oper

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged

H3C devices running firmware version NX15V100R015 are vulnerable to unauthorized access due to insecure default credenti

A command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the s

Dover Fueling Solutions ProGauge MagLink LX4 Devices fail to handle Unix time values beyond a certain point. An attacke

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker

An attacker with adjacent access, without authentication, can exploit this vulnerability to retrieve a hard-coded passw

A local attacker with low privileges on the Windows system where the software is installed can exploit this vulnerabili

An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credenti

Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standa

A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgi_main of the file /soap.

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerabi

A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknow

If the PATH environment variable contains paths which are executables (rather than just directories), passing certain st

A crafted system call argument can cause memory corruption.

SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys und