2025

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause improper validation of i

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware, where an attacker could cause an arbitrary memory read

NVIDIA DGX Spark GB10 contains a vulnerability in OSROOT firmware, where an attacker could cause an invalid memory read.

NVIDIA DGX Spark GB10 contains a vulnerability in SROOT firmware where an attacker could cause an out-of-bound write. A

Primakon Pi Portal 1.0.18 /api/v2/users endpoint is vulnerable to unauthorized data exposure due to deficient access con

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm adminis

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to Missing Au

The Chamber Dashboard Business Directory plugin for WordPress is vulnerable to unauthorized data export due to a missing

The Ace Post Type Builder plugin for WordPress is vulnerable to unauthorized custom taxonomy deletion due to missing aut

The atec Duplicate Page & Post plugin for WordPress is vulnerable to unauthorized post duplication due to missing author

The Admin and Customer Messages After Order for WooCommerce: OrderConvo plugin for WordPress is vulnerable to unauthoriz

The Social Images Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

The Bookme – Free Online Appointment Booking and Scheduling Plugin for WordPress is vulnerable to time-based SQL Injecti

The Job Board by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, an

The Frontend File Manager Plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to,

The AI Engine for WordPress: ChatGPT, GPT Content Generator plugin for WordPress is vulnerable to Arbitrary File Read in

The ProjectList plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up

The Just Highlight plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Highlight Color' setting i

The Inline frame – Iframe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedsite' shortcod

The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a miss

The Peer Publish plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

The Conditional Maintenance Mode for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all v

The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'locker

The Autochat Automatic Conversation plugin for WordPress is vulnerable to unauthorized modification of data due to a mis

The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t

The Zweb Social Mobile – Ứng Dụng Nút Gọi Mobile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t

The YouTube Subscribe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versio

MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue a

Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary s

"FOD" App uses hard-coded cryptographic keys, which may allow a local unauthenticated attacker to retrieve the cryptogra

Cross-site request forgery vulnerability exists in SNC-CX600W versions prior to Ver.2.8.0. If a user accesses a speciall

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of d

Inconsistent object size validation in time series processing logic may result in later processing of oversized BSON doc

Clients may successfully perform a TLS handshake with a MongoDB server despite presenting a client certificate not align

The Search Exclude plugin for WordPress is vulnerable to unauthorized modification of data due to a insufficient capabil

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

The Perfect Brands for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the `brands` attri

An issue in Blurams Lumi Security Camera (A31C) v23.1227.472.2926 allows local physical attackers to execute arbitrary c

A vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2. There are Ha

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting (XSS) via the "userName" parameter.

Improper input validation within AMD uprof can allow a local attacker to write to an arbitrary physical address, potenti

IBM Concert 1.0.0 through 2.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decry

Improper input validation within AMD uProf can allow a local attacker to write out of bounds, potentially resulting in a

Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user s

YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulner

OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.

An issue was discovered in Cinnamon kotaemon 0.11.0. The _may_extract_zip function in the \libs\ktem\ktem\index\file\ui.

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.5 and 6.2.1.