2025

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix uninitialized memcache pointer in u

In the Linux kernel, the following vulnerability has been resolved: module: ensure that kobject_put() is safe for modul

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer acc

In the Linux kernel, the following vulnerability has been resolved: can: m_can: m_can_class_allocate_dev(): initialize

APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation locally. Successful exp

An authenticated user can perform command injection via unsanitized input to the NetFax Server’s ping functionality via

An authenticated user can disclose the cleartext password of a configured SMTP server via an HTTP GET request to the /co

An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.178, the application performs insuffi

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ pa

The Map Block Leaflet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all v

In Teltonika Networks Remote Management System (RMS), it is possible to perform account pre-hijacking by misusing the in

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Stored

Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a st

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Server-Side Request Forgery (SSRF) via the

Versions of the package mcp-markdownify-server before 1.0.0 are vulnerable to Files or Directories Accessible to Externa

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Stored Cross-Site S

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation ME

CVE-2025-27706 is a cross-site scripting vulnerability in the management console of Absolute Secure Access prior to ver

CVE-2025-27703 is a privilege escalation vulnerability in the management console of Absolute Secure Access prior to ver

CVE-2025-27702 is a vulnerability in the management console of Absolute Secure Access prior to version 13.54. Attackers

SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability

Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and before & after v.11.1.25134.03 inserts Sensitive Info

Netwrix Directory Manager (formerly Imanami GroupID) before and including v.11.0.0.0 and after v.11.1.25134.03 has Incor

Netwrix Directory Manager v.11.0.0.0 and before & after v.11.1.25134.03 contains a hardcoded password.

In some cases, Kea log files or lease files may be world-readable. This issue affects Kea versions 2.4.0 through 2.4.1,

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an RT permalink.

Best Practical RT (Request Tracker) 5.0 through 5.0.7 allows XSS via JavaScript injection in an Asset name.

Best Practical RT (Request Tracker) 4.4 through 4.4.7 and 5.0 through 5.0.7 allows XSS via injection of crafted paramete

Improper neutralization of the value of the 'eventMoreText' property of the 'VCalendar' component in Vuetify allows unsa

An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x

An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.10

Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unautho

SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. T

SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vul

SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by u

The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibiliti

The TeleMessage service through 2025-05-05 stores certain cleartext information in memory, even though memory content ma

The TeleMessage service through 2025-05-05 implements authentication through a long-lived credential (e.g., not a token

The TeleMessage service through 2025-05-05 is based on a JSP application in which the heap content is roughly equivalent

The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heap

The admin panel in the TeleMessage service through 2025-05-05 allows attackers to discover usernames, e-mail addresses,

The TeleMessage service through 2025-05-05 relies on the client side (e.g., the TM SGNL app) to do MD5 hashing, and then

Netwrix Directory Manager (formerly Imanami GroupID) v.11.0.0.0 and before, as well as after v.11.1.25134.03 lacks Authe

Dell PowerStore, version(s) 4.0.0.0, contain(s) an Use of Hard-coded Credentials vulnerability in the PowerStore image f

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. M

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea a

SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be direct