2025

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with sna

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user t

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated

Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated use

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated us

Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the

Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excess

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated

Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbea

Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the

Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to exe

Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience all

'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.

Custom Question Answering Elevation of Privilege Vulnerability

Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-si

rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflo

merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vu

Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability i

An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence o

An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project thro

An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through co

A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remot

A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute ar

A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An

BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local,

BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connect

BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker c

BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance mo

BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection m

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions

Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace

Advantech WebAccess/SCADA  is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.

Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute ar

Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the ex

Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system t

A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.

Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. Th

A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unkno

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Ch

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious code into shipping

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via form v

An information disclosure vulnerability in Kentico Xperience allows public users to access sensitive administration inte

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the