2025

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expir

Unrestricted Upload of File with Dangerous Type vulnerability in Theme Egg ThemeEgg ToolKit themeegg-toolkit allows Uplo

An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead

An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in

AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish H

A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-

A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0

The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually const

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in a

Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate t

Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malic

An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.

VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework all

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-g

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag

The Javo Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.0.0.080

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script

A buffer overflow vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If exploited, the vulnerability co

A command injection vulnerability has been reported to affect QHora. If exploited, the vulnerability could allow remote

A files or directories accessible to external parties vulnerability has been reported to affect File Station 5. If explo

XWiki Confluence Migrator Pro helps admins to import confluence packages into their XWiki instance. A user that doesn't

The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and

The Golo - City Travel Guide WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeo

A vulnerability was discovered in the Arctera InfoScale 7.0 through 8.0.2 where a .NET remoting endpoint can be exploite

The WPCOM Member plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.7.5

crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php

An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 all

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x17

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety

Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.

A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application devel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informat

The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is

The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP

The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includ

The VEDA - MultiPurpose WordPress Theme theme for WordPress is vulnerable to PHP Object Injection in all versions up to,

An unauthenticated remote attacker can use hard-coded credentials to gain full administration privileges on the affected

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Per

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmwar

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote C

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable Open

Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP K