2025

SAP FICA ODN framework allows a high privileged user to inject value inside the local variable which can then be execute

The Social Streams plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.

The Fleetwire Fleet Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fleetw

The Omnishop plugin for WordPress is vulnerable to Unauthenticated Registration Bypass in all versions up to, and includ

The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all ver

The Realty Portal – Agent plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within

The YANewsflash plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forg

The Valuation Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘link’ parameter in a

A vulnerability has been found in Tenda AC23 16.03.07.52 and classified as critical. Affected by this vulnerability is t

PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9,

HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs versions 11.0.12

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vu

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vu

A potential privilege escalation through Sudo vulnerability has been identified in the Poly Clariti Manager for versions

A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vu

A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions pr

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vu

A potential SQL injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. T

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The vu

A potential command injection vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corr

Type Confusion in V8 in Google Chrome prior to 138.0.7204.168 allowed a remote attacker to potentially exploit heap corr

Lantronix Provisioning Manager is vulnerable to XML external entity attacks in configuration files supplied by network d

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and

pyLoad is a free and open-source Download Manager written in pure Python. In version 0.5.0b3.dev89, an authenticated pat

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of netwo

HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were dis

yt-dlp is a feature-rich command-line audio/video downloader. In versions 2025.06.25 and below, when the --exec option i

DuraComm SPM-500 DP-10iN-100-MU transmits sensitive data without encryption over a channel that could be intercepted b

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric

DuraComm SPM-500 DP-10iN-100-MU lacks access controls for a function that should require user authentication. This cou

DuraComm SPM-500 DP-10iN-100-MU is vulnerable to a cross-site scripting attack. This could allow an attacker to preven

Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption a

Focus incorrectly truncated URLs towards the beginning instead of around the origin. This vulnerability was fixed in Fir

Memory safety bugs present in Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these b

In some cases search terms persisted in the URL bar even after navigating away from the search page. This vulnerability

Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox

Setting a nameless cookie with an equals sign in the value shadowed other cookies. Even if the nameless cookie was set o

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebindin

Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Fire

Memory safety bugs present in Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunder

The JavaScript engine did not handle closed generators correctly and it was possible to resume them leading to a nullptr

XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fix

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authenti

Insufficient escaping in the “Copy as cURL” feature could potentially be used to trick a user into executing unexpected

Thunderbird executed `javascript:` URLs when used in `object` and `embed` tags. This vulnerability was fixed in Firefox

On arm64, a WASM `br_table` instruction with a lot of entries could lead to the label being too far from the instruction

On 64-bit platforms IonMonkey-JIT only wrote 32 bits of the 64-bit return value space on the stack. Baseline-JIT, howeve