2025

An issue in Tenda W18E v.2.0 v.16.01.0.11 allows an attacker to execute arbitrary code via the editing functionality of

IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. A

IBM Sterling Secure Proxy 6.0.0.0 through 6.0.3.1, 6.1.0.0 through 6.1.0.0, and 6.2.0.0 through 6.2.0.1 uses weaker than

IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code du

aws-mcp-server MCP server is vulnerable to command injection. An attacker can craft a prompt that once accessed by the M

Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof o

Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2.

Sourcecodester Web-based Pharmacy Product Management System v.1.0 has a file upload vulnerability. An attacker can uploa

Reflected Cross-Site Scripting (XSS) vulnerability in Real Easy Store. This vulnerability allows an attacker to execute

Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT req

A vulnerability was found in SourceCodester Client Database Management System 1.0. It has been declared as critical. Thi

A vulnerability, which was classified as critical, was found in Campcodes Online Hospital Management System 1.0. Affecte

A vulnerability, which was classified as critical, has been found in SourceCodester Computer Store System 1.0. This issu

Hackney fails to properly release HTTP connections to the pool after handling 307 Temporary Redirect responses. Remote a

A vulnerability classified as critical was found in FreeFloat FTP Server 1.0.0. This vulnerability affects unknown code

A Missing Authorization vulnerability has been found in DinoRANK. This vulnerability allows an attacker to access invoi

The WP Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions u

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the impro

The Likes and Dislikes Plugin plugin for WordPress is vulnerable to SQL Injection via the 'post' parameter in all versio

The WP Attachments plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘attachment_id’ paramete

A buffer over-read in Fortinet FortiOS versions 7.4.0 through 7.4.3, versions 7.2.0 through 7.2.7, and versions 7.0.0 th

A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may all

A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5,

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through

An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 th

A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindow

A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager v

A missing authorization in Fortinet FortiManager versions 7.2.0 through 7.2.1, and versions 7.0.0 through 7.0.7 may allo

libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is n

libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an I

The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a w

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validati

IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of

IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authent

IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error

n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 st

On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection confi

IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerabilit

On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address s

NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the aut

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap c

Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially

Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap

When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the drive

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'su

A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a s