2025

ESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if maliciou

ACL configured in ip_allow.config or remap.config does not use IP addresses that are provided by PROXY protocol. Users

The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized view and modifi

The Football Pool plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions u

The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was id

The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpdm_user_dashbo

The Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress is

pgai is a Python library that transforms PostgreSQL into a retrieval engine for RAG and Agentic applications. Prior to c

OpenList Frontend is a UI component for OpenList. Prior to version 4.0.0-rc.4, a vulnerability exists in the file previe

A path transversal vulnerability in Brocade Fabric OS 9.1.0 through 9.2.2 could allow a local admin user to gain acces

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does no

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all r

The Versa Director SD-WAN orchestration platform provides functionality to upload various types of files. However, the J

The Versa Director software exposes a number of services by default and allow attackers an easy foothold due to default

A vulnerability allowing local system users to modify directory contents, allowing for arbitrary code execution on the l

A vulnerability allowing an authenticated user with the Backup Operator role to modify backup jobs, which could execute

The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the D

The Versa Director SD-WAN orchestration platform includes a Webhook feature for sending notifications to external HTTP e

The Versa Director SD-WAN orchestration platform provides an option to upload various types of files. The Versa Director

The Versa Director SD-WAN orchestration platform includes functionality to initiate SSH sessions to remote CPEs and the

The Versa Director SD-WAN orchestration platform allows customization of the user interface, including the header, foote

The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication (2FA) using One-Time Passcodes (OT

A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user

The Versa Director SD-WAN orchestration platform which makes use of Cisco NCS application service. Active and Standby Di

CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad

CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javasc

CloudClassroom-PHP-Project v1.0 is affected by an insecure credential transmission vulnerability. The application transm

Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially exploit heap

Integer overflow in V8 in Google Chrome prior to 137.0.7151.119 allowed a remote attacker to potentially perform out of

An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP Se

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The

A vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated, remote attacker to cause a buffe

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devic

A vulnerability in Universal Disk Format (UDF) processing of ClamAV could allow an unauthenticated, remote attacker to c

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulne

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 could allo

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnera

Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to

Impact Cloudflare quiche was discovered to be vulnerable to incorrect congestion window growth, which could cause it to

A missing length check in `ogs_pfcp_subnet_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 an

A missing length check in `ogs_pfcp_dev_add` function from PFCP library, used by both smf and upf in open5gs 2.7.2 and e

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 is vulnerable to an XML external entity injection (XXE)

IBM webMethods Integration Server 10.5, 10.7, 10.11, and 10.15 could allow a privileged user to escalate their privilege

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnera

Improper Input Validation vulnerability in Profisee on Windows (filesystem modules) allows Path Traversal after authenti

SQL Injection vulnerability in pbootCMS v.3.2.5 and v.3.2.10 allows a remote attacker to obtain sensitive information vi