2025

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-s

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana –

Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting I

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy

Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Contro

A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the fil

Incomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade the entropy of the RDR

Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may cau

Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect funct

Out-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful exploitation of this vulnerabilit

Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerabi

Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability ma

An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the

The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of i

RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted f

Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI ver

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.

Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacke

The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions

The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.

Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 conta

ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 th

Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session ex

Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using A

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower t

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions belo

Azure Bot Service Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose informati

Azure Entra ID Elevation of Privilege Vulnerability

Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability

contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versi

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 thro

Azure Networking Elevation of Privilege Vulnerability

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All version

Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All version

In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enablin

In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to b

In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility se

In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This

In android_app of Android.bp, there is a possible way to launch any activity as a system user. This could lead to local

In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permiss

In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new

In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility s

In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the

In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default va