2025

A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior t

A Clickjacking vulnerability in TP-Link Archer C1200 web management page allows an attacker to trick users into perfor

Use of Hard-coded Credentials in TP-Link Archer C50 V3( <= 180703)/V4( <= 250117 )/V5( <= 200407 ), and C20

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path trave

The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/admin.js` con

LITEON IC48A firmware versions prior to 01.00.19r and LITEON IC80A firmware versions prior to 01.01.12e store FTP-server

VoidBot Open-Source is a customizable Discord bot. VoidBot Open-Source versions 0.0.1 through 0.8.1 contain a vulnerabil

A multi-vendor cache poisoning vulnerability named 'Rebirthday Attack' has been discovered in caching resolvers that sup

Vue I18n is the internationalization plugin for Vue.js. The escapeParameterHtml: true option in Vue I18n is designed to

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the  ci

This vulnerability exists in Digisol DG-GR6821AC Router due to use of default admin credentials at its web management in

This vulnerability exists in Digisol DG-GR6821AC Router due to misconfiguration of both Secure and HttpOnly flags on ses

This vulnerability exists in Digisol DG-GR6821AC Router due to cleartext transmission of credentials in its web manageme

This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the

This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuratio

An improper access control vulnerability was found in the EZ Sync Manager of ADM, which allows authenticated users to c

SQL injection vulnerability in SCATI Vision Web of SCATI Labs from version 4.8 to 7.2. This vulnerability allows an atta

Stored Cross-Site Scripting (XSS) vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to exe

The Scratch Channel is a news website that is under development as of time of this writing. The file `/api/users.js` doe

A remote command execution vulnerability exists in IPFire before version 2.19 Core Update 101 via the 'proxy.cgi' CGI in

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14

An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpr

A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated att

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writ

A stack-based buffer overflow vulnerability exists in the login functionality of Disk Pulse Enterprise version 9.0.34. A

A buffer overflow vulnerability exists in the WinaXe FTP Client version 7.7 within the FTP banner parsing functionality,

A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image

A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28,

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin

An unauthenticated command injection vulnerability exists in WePresent WiPG-1000 firmware versions prior to 2.2.3.0, due

An unauthenticated remote command execution vulnerability exists in Samsung WLAN AP WEA453e firmware prior to version 5.

GitHub Kanban MCP Server is a Model Context Protocol (MCP) server for managing GitHub issues in Kanban board format and

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11

A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. A

The Avid Nexis Agent uses a vulnerable gSOAP version. An undocumented vulnerability impacting gSOAP v2.8 makes the appli

An authenticated Arbitrary File Deletion vulnerability enables an attacker to delete critical files. This issue affects

An Unauthenticated Arbitrary File Read vulnerability affects the Agent when installed on a system. The parameter filenam

A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to i

An issue in Cato Networks' CatoClient for Linux, before version 5.5, allows a local attacker to escalate privileges to r

An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with

immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong co

A CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthenticated remote code execu

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that could cause remote comman

A CWE-331: Insufficient Entropy vulnerability exists that could cause root password discovery when the password generati

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exist

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause manipulati

When passing values outside of the expected range to QColorTransferGenericFunction it can cause a denial of service, for