2025

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflo

OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains a

AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQ

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could caus

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-sid

CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0.

Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extractin

WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log in

app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, rela

Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerabi

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affec

DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may

Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may

UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may af

An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpo

An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multipl

SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uplo

Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths

The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type valida

The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including

The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This

Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Spe

Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Proper

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled R

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited

TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, explo

An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and

OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable

OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can crea

Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course sett

Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the

Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive inf

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, p

The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys.

Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters int

Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the au

An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department havi

Ruoyi v4.8.0 vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the reset

Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary opera

A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_u