2025

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark dev

A heap-buffer-overflow write exists in jpeg2000dec FFmpeg which allows an attacker to potentially gain remote code execu

A vulnerability exists in the ConsoleFindCommandMatchList function in libsymproc. so imported by ctpd that may lead to u

A code execution security issue exists in the affected product. An attacker with physical access could abuse the mainten

A security issue affecting multiple Cisco devices also directly impacts Stratix® 5410, 5700, and 8000 devices. This can

A SQL injection vulnerability has been identified in the SMPP server component of the SMSEagle firmware, specifically af

Cattown is a JavaScript markdown parser. Versions prior to 1.0.2 used regular expressions with inefficient, potentially

pREST (PostgreSQL REST), is an API that delivers an application on top of a Postgres database. SQL injection is possible

Maho is a free and open source ecommerce platform. In Maho prior to 25.9.0, an authenticated staff user with access to t

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported i

The XWiki blog application allows users of the XWiki platform to create and manage blog posts. Prior to version 9.14, th

@akoskm/create-mcp-server-stdio is an MCP server starter kit that uses the StdioServerTransport. Prior to version 0.0.13

An integer overflow exists in the FTS5 https://sqlite.org/fts5.html  extension. It occurs when the size of an array of

Reflected Cross-Site Scripting (XSS) vulnerability in WebWork, which allows remote attackers to execute arbitrary code t

Cross-site Scripting (XSS) vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS

ITCube CRM in versions from 2023.2 through 2025.2 is vulnerable to path traversal. Unauthenticated remote attacker is ab

Incorrect Authorization vulnerability in ash-project ash allows Exploiting Incorrectly Configured Access Control Securit

internetarchive is a Python and Command-Line Interface to Archive.org In versions 5.5.0 and below, there is a directory

An authenticated attacker may remotely execute arbitrary code via the CWMP binary on the devices AX10 and AX1500.  The

DeepDiff is a project focused on Deep Difference and search of any Python data. Versions 5.0.0 through 8.6.0 are vulnera

Onyxia is a data science environment for kubernetes. In versions 4.6.0 through 4.8.0, Onyxia-API leaked the credentials

On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Inje

Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on

The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulne

ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 th

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower t

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versi

dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability in the /api/v1/contenttype endpo

Securing externally available CAN wires can easily allow physical access to the CAN bus, allowing possible injection of

Input from search query parameter in GOV CMS is not sanitized properly, leading to a Blind SQL injection vulnerability,

When the Vaadin Upload's start listener is used to validate metadata about an incoming upload, it is possible to bypass

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions

Kaleo Forms Admin in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 27, and older u

SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of a

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREEN

Cross-Frame Scripting (XFS) vulnerability in BoomCMS v9.1.4 from UXB London. XFS is a web attack technique that exploits

PaperCut Print Deploy is an optional component that integrates with PaperCut NG/MF which simplifies printer deployment a

Local Deep Research is an AI-powered research assistant for deep, iterative research. Versions 0.2.0 through 0.6.7 store

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly a

E2 Facility Management Systems use a proprietary protocol that allows for unauthenticated file operations on any file in

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traef

The ns_backup extension through 13.0.2 for TYPO3 allows command injection.

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to change other us

Lack of authorisation in Deporsite by T-INNOVA. This vulnerability allows an unauthenticated attacker to obtain informat

XML Injection vulnerability in xmltodict allows Input Data Manipulation. This issue affects xmltodict: from 0.14.2 befor

StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the Stre

Delta Electronics DIAView has an authentication bypass vulnerability.

A vulnerability in XAMPP, developed by Apache Friends, version 1.7.3's default WebDAV configuration allows remote authen

Sunway ForceControl version 6.1 SP3 and earlier contains a stack-based buffer overflow vulnerability in the SNMP NetDBSe

WM Downloader version 3.1.2.2 is vulnerable to a buffer overflow when processing a specially crafted .m3u playlist file.