2025

In the Linux kernel, the following vulnerability has been resolved: veth: reduce XDP no_direct return section to fix ra

The PhastPress plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read via null byte injection in all

net-snmp is a SNMP application library, tools and daemon. Prior to versions 5.9.5 and 5.10.pre2, a specially crafted pac

Authentication bypass vulnerability in Xiongmai XM530 IP cameras on Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.

ProjectSend r1605 contains a remote code execution vulnerability that allows attackers to upload malicious files by mani

Screen SFT DAB 600/C Firmware 1.9.3 contains a session management vulnerability that allows attackers to bypass authenti

SOUND4 LinkAndShare Transmitter 1.1.2 contains a format string vulnerability that allows attackers to trigger memory sta

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated vulnerability in the /usr/cgi-bin/restorefactory.cgi endp

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an unauthenticated OS command injection vulnerability that allows remote att

SOUND4 IMPACT/FIRST/PULSE/Eco version 2.x contains an SQL injection vulnerability in the 'index.php' authentication mech

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x contains an insecure direct object reference vulnerability that allows attackers to b

ClipBucket 5.5.2 is affected by an improper access control issue where the product is shipped or deployed with hardcoded

Iframe injection vulnerability in airc.pt/solucoes-servicos.solucoes MyNET v.26.06 and before allows a remote attacker t

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a

An arbitrary file upload vulnerability in the Attachments module of Frappe Framework v15.89.0 allows attackers to execut

Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons al

Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may c

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary

Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary

Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated

A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/S

A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality

A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of th

The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.

The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type

n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.

FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placin

Kimai 1.30.10 contains a SameSite cookie vulnerability that allows attackers to steal user session cookies through malic

Ever Gauzy v0.281.9 contains a JWT authentication vulnerability that allows attackers to exploit weak HMAC secret key im

InnovaStudio WYSIWYG Editor 5.4 contains an unrestricted file upload vulnerability that allows attackers to bypass file

Lilac-Reloaded for Nagios 2.0.8 contains a remote code execution vulnerability in the autodiscovery feature that allows

A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083_B20200521. This affects the function sprintf of the file /cg

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stor

An issue in GT Edge AI Community Edition Versions before v2.0.12 allows attackers to execute arbitrary code via injectin

Galette is a membership management web application for non profit organizations. Prior to version 1.2.0, while updating

Glutton V1 service endpoints were exposed without any authentication on Gotham stacks, this could have allowed users tha

Improper Restriction of Excessive Authentication Attempts vulnerability in Restajet Information Technologies Inc. Online

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attac

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration re

Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to exe

Custom Question Answering Elevation of Privilege Vulnerability

Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability i

EasyPHP Webserver 14.1 contains an OS command injection vulnerability that allows unauthenticated attackers to execute a

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file inclu

Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.

A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange

A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and includ

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-f

A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup en