2025

Navidrome is an open source web-based music collection server and streamer. Versions 0.55.0 through 0.55.2 have a vulner

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been id

A use after free memory corruption issue exists in Yandex Browser for Desktop prior to version 24.4.0.682

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. Prior to version 1.6.6, Fabio allows cl

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated

Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a

An insufficient database Row-Level Security policy in Lovable through 2025-04-15 allows remote unauthenticated attackers

Tinxy WiFi Lock Controller v1 RF was discovered to be configured to transmit on an open Wi-Fi network, allowing attacker

A buffer overflow, as described in CVE-2020-8927, exists in the embedded Brotli library.  Versions of IO::Compress::Brot

The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string i

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to ch

Instantel Micromate lacks authentication on a configuration port which could allow an attacker to execute commands if co

The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to

This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4

Esri Portal for ArcGIS 11.4 and prior allows a remote, unauthenticated attacker to bypass the Portal’s SSRF protections.

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4,

Deserialization of Untrusted Data vulnerability in ThimPress Course Builder course-builder allows Object Injection.This

An issue in Open Network Foundation ONOS v2.7.0 allows attackers to create fake IP/MAC addresses and potentially execute

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check o

Netwrix Directory Manager (formerly Imanami GroupID) through v.10.0.7784.0 has a hard-coded password.

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation ME

Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Info

An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code du

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the M

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager v

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the aut

Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and gener

The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated r

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbit

Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the t

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers'

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus t

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update a

Time-based blind SQL injection vulnerabilities in TCMAN's GIM v11. These allow an attacker to retrieve, create, update a

Missing authentication vulnerability in TCMAN GIM v11. This allows an unauthenticated attacker to access the resources /

Improper Restriction of Operations within the Bounds of a Memory Buffer and Stack-based Buffer Overflow vulnerabilities

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) whi

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insuffi

An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor

PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerabil

Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issu

Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Inject

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support M

Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeepe

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web

Unrestricted Upload of File with Dangerous Type vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketi

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Regi