2025

This issue was addressed through improved state management. This issue is fixed in iOS 26 and iPadOS 26. Private Browsin

A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Ta

The issue was addressed by adding additional logic. This issue is fixed in macOS Tahoe 26. An app may be able to overrid

A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue i

A flaw has been found in SourceCodester Online Student File Management System 1.0. Affected by this vulnerability is an

An HTTP Request Smuggling [CWE-444] vulnerability in the Authentication portal of WatchGuard Fireware OS allows a remote

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

An issue in PHPGurukul Online-Library-Management-System v3.0 allows an attacker to escalate privileges via the index.php

A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execut

SourceCodester Web-based Pharmacy Product Management System 1.0 is vulnerable to Incorrect Access Control, which allows

Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7

In Liferay Portal 7.1.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update

A vulnerability was detected in SourceCodester Online Student File Management System 1.0. Affected is an unknown functio

A security vulnerability has been detected in SourceCodester Online Student File Management System 1.0. This impacts an

A weakness has been identified in SourceCodester Online Student File Management System 1.0. This affects an unknown func

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over

FreePBX is an open-source web-based graphical user interface. In FreePBX 15, 16, and 17, malicious connections to the Ad

FreePBX is an open-source web-based graphical user interface. From 17.0.19.11 to before 17.0.21, authenticated users of

Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 202

Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92 and 7.3 GA through update 35 allows a time-

A security flaw has been discovered in SourceCodester Online Student File Management System 1.0. The impacted element is

A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affec

3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser funct

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayis

error-ex allows error subclassing and stack customization. On 8 September 2025, an npm publishing account for error-ex w

color-convert provides plain color conversion functions in JavaScript. On 8 September 2025, the npm publishing account f

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client

debug is a JavaScript debugging utility. On 8 September 2025, the npm publishing account for debug was taken over after

color is a Javascript color conversion and manipulation library. On 8 September 2025, the npm publishing account for col

color-string is a parser and generator for CSS color strings. On 8 September 2025, the npm publishing account for color-

simple-swizzle swizzles function arguments. On 8 September 2025, the npm publishing account for simple-swizzle was taken

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken

The Positron PX360BT SW REV 8 car alarm system is vulnerable to a replay attack due to a failure in implementing rolling

Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An

A weakness has been identified in SpyShelter up to 15.4.0.1015. Affected is an unknown function in the library SpyShelte

libocpp before 0.28.0 allows a denial of service (EVerest crash) because a secondary exception is thrown during error me

The OCPP implementation in libocpp before 0.26.2 allows a denial of service (EVerest crash) via JSON input larger than 2

Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q

A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1. This impacts the function filterKeyword of the f

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download

Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject

Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0

A vulnerability in Apache Fory allows a remote attacker to cause a Denial of Service (DoS). The issue stems from the ins

hackmd-mcp is a Model Context Protocol server for integrating HackMD's note-taking platform with AI assistants. From 1.4

Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12 the H2 data sou

n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scriptin

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vu

On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpip

An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and p

Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx.