2025

The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_bu

The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's

In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-lev

The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in a

Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2.

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vuln

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ima

The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.

An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 b

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple P

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with p

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with p

Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to in

Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located wit

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions start

An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.

fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetratio

A remote code execution vulnerability exists in Kaltura versions prior to 11.1.0-2 due to unsafe deserialization of user

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode d

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set o

LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, t

Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial

Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 an

The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocat

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.

A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and th

Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18

During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\window

A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers

vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticat

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disc

Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in i

A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication

A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauth

A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to

A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker t

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated use

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a sp

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused b

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused b

IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 transmits sensitive information without encryption that

A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true". Users are recomm

In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module direc

An authenticated arbitrary file upload vulnerability exists in the SMA 100 series web management interface. A remote att

Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authenticati

A remote code execution vulnerability exists within osCommerce Online Merchant version 2.3.4.1 due to insecure default c