2025

Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with

Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users. In

While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this a

DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS). Improper input validation in s

Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alib

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notific

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to v

MacOS version of Poedit bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissi

The component listed above contains a vulnerability that can be exploited by an attacker to perform a SQL Injection atta

Stored XSS in TIBCO ActiveMatrix Administrator allows malicious data to appear to be part of the website and run within

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. P

Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Priv

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in HYPR Passwo

Data provided in a request performed to the server while activating a new device are put in a database. Other high privi

Input provided in a field containing "activationMessage" in Konsola Proget is not sanitized correctly, allowing a high-p

Input provided in comment section of Konsola Proget is not sanitized correctly, allowing a high-privileged user to perfo

A low-privileged user can access information about profiles created in Proget MDM (Mobile Device Management), which cont

In Proget MDM, a low-privileged user can access information about changes contained in backups of all devices managed by

In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities res

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Dev

The affected products could allow an unauthenticated attacker to access system information that could enable further acc

SQL injection vulnerability in Comerzzia Backoffice: Sales Orchestrator 3.0.15. This vulnerability allows an attacker to

Stack-based buffer overflow vulnerability in the 'conn-indicator' binary running as root on the TP-Link Archer AX50 rout

A Stored Cross-Site Scripting (XSS) vulnerability has been found in Koibox for versions prior to e8cbce2. This vulnerab

Broadcom Automic Automation Agent Unix versions < 24.3.0 HF4 and < 21.0.13 HF1 allow low privileged users who have execu

A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.

A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances vi

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard

Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib modu

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform di

DumbDrop, a file upload application that provides an interface for dragging and dropping files, has a DOM cross-site scr

Atheos is a self-hosted browser-based cloud IDE. Prior to v602, similar to GHSA-rgjm-6p59-537v/CVE-2025-22152, the `$tar

Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, t

Vyper is the Pythonic Programming Language for the Ethereum Virtual Machine. In versions up to and including 0.4.2rc1, `

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using t

Insecure Direct Object Reference (IDOR) vulnerability in the eSignaViewer component in eSigna product versions 1.0 to 1.

Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on W

Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers. Since version 1.14.0, PCL by default

Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are delet

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® softwar

Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, P

A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute a

A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Netw

A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to dis

An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto N

CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Pe

Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In version