2025

Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cro

fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttool

Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerabil

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerabi

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.

Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affec

Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks

Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v

File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0.

Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0.

Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.

WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit

WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrar

WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrar

app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XM

Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to

Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability ma

UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availabili

Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability m

Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability ma

The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u

Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability

Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may a

Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect

Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect s

Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulner

Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affec

Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability w

UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may af

Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect s

An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended p

Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team em

Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects De

The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vul

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResour

In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This

Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintend

Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the us

Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can

Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintend

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due t

The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forge

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and inc

The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versio

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions