2025

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 could allow an a

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 stores source co

IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and 12.0.4 is vulnerable to

os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a danglin

An unrestricted file upload vulnerability exists in the Product Image section of the VirtueMart backend. Authenticated a

A Cross-Site Request Forgery (CSRF) vulnerability exists in the product image upload function of VirtueMart that bypasse

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive inf

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of th

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. Th

An incorrect default permissions vulnerability was reported in the MotoSignature application that could result in unauth

Null pointer exception vulnerabilities were reported in the fingerprint sensor service that could allow a local attacker

The iSTAR Configuration Utility (ICU) tool leaks memory, which could result in the unintended exposure of unauthorized d

ClipShare is a lightweight and cross-platform tool for clipboard sharing. Prior to 3.8.5, ClipShare Server for Windows u

pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is config

Allocation of Resources Without Limits or Throttling vulnerability in Drupal Admin Audit Trail allows Excessive Allocati

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Lightgaller

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affec

Incorrect Authorization vulnerability in Drupal Commerce Eurobank (Redirect) allows Functionality Misuse.This issue affe

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Bl

Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Bl

IBM Security Guardium 12.1 could allow a local privileged user to escalate their privileges to root due to insecure inhe

IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames

Nomad Community and Nomad Enterprise (“Nomad”) prefix-based ACL policy lookup can lead to incorrect rule application and

A maliciously crafted .usdc file, when loaded through Autodesk Maya, can force an uncontrolled memory allocation vulnera

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a

A password is exposed locally.

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-date-*’ paramete

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's de

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects M

An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Fir

Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.

The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘HTTP_REFERER’

Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LD

Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowi

The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all vers

For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary comman

An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack o

The SIMCom SIM7600G modem supports an undocumented AT command, which allows an attacker to execute system commands with

There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module. This only affects HTTP/

SunGrow's back end users system iSolarCloud https://isolarcloud.com  uses an MQTT service to transport data from the us

The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file typ

A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manu

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the d

The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1

The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versi

Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the

Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside