2025

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shorten

In multispectral MIFF image processing in ImageMagick before 7.1.1-44, packet_size is mishandled (related to the renderi

In Tenda ac9 v1.0 with firmware V15.03.05.14_multi, the rebootTime parameter of /goform/SetSysAutoRebbotCfg has a stack

In Tenda AC9 v1.0 with firmware V15.03.05.14_multi, the security parameter of /goform/WifiBasicSet has a stack overflow

In MIFF image processing in ImageMagick before 7.1.1-44, image depth is mishandled after SetQuantumFormat is used.

A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to

The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modif

This vulnerability exists in Meon Bidding Solutions due to improper authorization controls on certain API endpoints for

This vulnerability exists in Meon KYC solutions due to debug mode is enabled in certain API endpoints. A remote attacker

This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the respo

This vulnerability exists in Meon KYC solutions due to improper handling of access and refresh tokens in certain API end

This vulnerability exists in Meon KYC solutions due to insufficient server-side validation of the Captcha in certain API

This vulnerability exists in Meon KYC solutions due to missing restrictions on the number of incorrect One-Time Password

The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Stored Cross-Site Scrip

A vulnerability was found in mod_proxy_cluster. The issue is that the <Directory> directive should be replaced by the <L

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to product price manipulation in all versions up t

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions

An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization templa

A malicious third party could invoke a persistent denial of service vulnerability in FireEye EDR agent by sending a spec

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has identified an issue with a specific file that the

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to

Missing authorization vulnerability in synocopy in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-

A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions

A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Se

A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access

xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4

D-Link DIR-816 A2V1.1.0B05 was found to contain a command injection in /goform/delRouting.

Laravel Starter 11.11.0 is vulnerable to Cross Site Scripting (XSS) in the tags feature. Any user with the ability of cr

SAP Learning Solution is vulnerable to Cross-Site Request Forgery (CSRF), allowing an attacker to trick authenticated us

SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which

Francois Jacquet RosarioSIS v12.0.0 was discovered to contain a content spoofing vulnerability in the Theme configuratio

NVIDIA NvContainer service for Windows contains a vulnerability in its usage of OpenSSL, where an attacker could exploit

A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System

A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4

A cross-site scripting (reflected XSS) vulnerability was found in Mettler Toledo FreeWeight.Net Web Reports Viewer 8.4.0

LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the

DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence

MuM (aka Mensch und Maschine) MapEdit (aka mapedit-web) 24.2.3 is vulnerable to SQL Injection that allows an attacker to

Codemers KLIMS 1.6.DEV allows Python code injection. A user can provide Python code as an input value for a parameter or

Codemers KLIMS 1.6.DEV lacks a proper access control mechanism, allowing a normal KLIMS user to perform all the actions

TCPWave DDI 11.34P1C2 allows Remote Code Execution via Unrestricted File Upload (combined with Path Traversal).

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting

MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided f

The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTT

The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which co

CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

Jmix is a set of libraries and tools to speed up Spring Boot data-centric application development. In versions 1.0.0 to

OctoPrint provides a web interface for controlling consumer 3D printers. In versions up to and including 1.10.3, OctoPri