2025

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roninwp FAT Event

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WittyFolk Bonjour

Improper Encoding or Escaping of Output vulnerability in Ays Pro Poll Maker poll-maker.This issue affects Poll Maker: fr

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when fun

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix unexpectedly changed path in ksmbd_vfs_k

In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid e

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace rq_lock() to raw_spin_rq_lock()

In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage dat

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system s

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_ini

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At th

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cach

In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() di

Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email

Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a si

In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sct

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during dest

In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array

In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queue

In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When

In the Linux kernel, the following vulnerability has been resolved: tracing: Have process_string() also allow arrays I

The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality i

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted requ

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resul

Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process

The wp-greet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.2.

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to Limit

The FireCask Like & Share Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' param

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some

NEC Corporation's WebSAM DeploymentManager v6.0 to v6.80 allows an attacker to reset configurations or restart products

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in al

The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthori

The WP-BibTeX plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0

The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up

On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-pro

The 1003 Mortgage Application plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and incl

IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensi

Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mod

Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 allows web pages to be stored locally which c

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses Cross-Origin Resource Sharing (CORS) whi

IBM DevOps Velocity 5.0.0 and IBM UrbanCode Velocity 4.0.0 through 4.0. 25 uses weaker than expected cryptographic algor

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulne

CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development s

PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send request

gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions whe

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in t

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow