2025

Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted java

Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Uploa

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting t

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When drive

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill

ENENSYS IPGuard v2 2.10.0 was discovered to contain hardcoded credentials.

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Ma

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreS

A remote code execution vulnerability in GFI Kerio Control 9.4.5 allows attackers with administrative access to upload a

A missing authentication vulnerability in the GFIAgent component of GFI Kerio Control 9.4.5 allows unauthenticated remot

An authentication bypass vulnerability exists in GFI Kerio Control 9.4.5 due to insecure default proxy configuration and

The education theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.10 via

The Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads

The Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress is vulnerable to Local File Inclus

linjiashop <=0.9 is vulnerable to Incorrect Access Control. When using the default-generated JWT authentication, attacke

Improper mstatus.SUM bit retention (non-zero) in Open-Source RISC-V Processor commit f517abb violates privileged spec co

gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS (NativeWind). Prior to commi

A remote code execution vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.

Improper Control of Generation of Code ('Code Injection') vulnerability in bitto.kazi Custom Login And Signup Widget cus

zrlog v3.1.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the downloadUrl parameter.

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the a

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possibl

The Opal Estate Pro – Property Management and Submission plugin for WordPress, used by the FullHouse - Real Estate Respo

Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.628.4510, the web UI of Sunshine lacks p

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypas

DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, there is a bypas

Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled director

An issue D-Link DIR-816-A2 DIR-816A2_FWv1.10CNB05_R1B011D88210 allows a remote attacker to execute arbitrary code via sy

Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java cl

SQL injection vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to retrieve, create, up

In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processi

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLotti

Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.2

Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie:

Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0.

Multiple Authenticated SQL Injection vulnerabilities found in UISP Application (Version 2.4.206 and earlier) could allow

The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit all

Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This security vulnerability is the same a

The PT Project Notebooks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication fra

PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbit

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Softwar

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Woww

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile In

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics C

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Bl

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token whi

Cross-Site Request Forgery (CSRF) vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affe