2025

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

The Booking Plugin for WordPress Appointments – Time Slot plugin for WordPress is vulnerable to unauthorized email sendi

The WP Login and Register using JWT plugin for WordPress is vulnerable to unauthorized access of data due to a missing c

The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to unauthorized modification of data due to n incorrect

The WSChat – WordPress Live Chat plugin for WordPress is vulnerable to unauthorized modification of data due to a missin

The Pet-Manager – Petfinder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kwm-petfinder shor

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up t

The Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings plugin for WordPress is vulnerable to

The Quiz Maker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including

The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Auth

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['fi

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl

The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and inclu

The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up

Tanium addressed an arbitrary file deletion vulnerability in TanOS.

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a boolean-based

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cros

Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any

Open Forms allows users create and publish smart forms. Prior to versions 3.2.7 and 3.3.3, forms where the prefill data

XWiki AdminTools integrates administrative tools for managing a running XWiki instance. Prior to version 1.1, users with

The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains a reflected Cross-Site Scripting

A mongoc_bulk_operation_t may read invalid memory if large options are passed.

The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking

A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduc

pnetlab 5.3.11 is vulnerable to Command Injection via the qemu_options parameter.

The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping fo

A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free iss

A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (

A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootl

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary f

A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because t

A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (

In Ascertia SigningHub through 8.6.8, there is a lack of rate limiting on the invite user function, leading to an email

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote at

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticate

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenti

A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenti

A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vu

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password re

kishan0725 Hospital Management System has a Cross-Site Scripting (XSS) vulnerability in appsearch.php via the email para

kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment

kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleti

A remote command execution (RCE) vulnerability was discovered in all H3C ERG3/ERG5 series routers and XiaoBei series rou

A Cleartext Storage of Sensitive Information in Memory vulnerability [CWE-316] in Fortinet FortiPAM 1.6.0, FortiPAM 1.5

A use of hard-coded credentials vulnerability in Fortinet FortiWeb 7.6.0, FortiWeb 7.4 all versions, FortiWeb 7.2 all ve

Cross site scripting (XSS) vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted P

An improper neutralization of crlf sequences ('crlf injection') vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3,

An exposure of sensitive information to an unauthorized actor vulnerability in Fortinet FortiADC 7.4.0, FortiADC 7.2 all

An active debug code vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through

pluginsGLPI's Database Inventory Plugin "manages" the Teclib' inventory agents in order to perform an inventory of the d