2025

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use s

A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify

A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files a

In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.

In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass

code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone

A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the co

A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351

HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validat

HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an

A replay attack vulnerability was discovered in a Zigbee smart home kit manufactured by Ksix (Zigbee Gateway Module = v1

BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerab

E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0,

OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linu

Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network.

A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function

A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the or

In JotUrl 2.0, is possible to bypass security requirements during the password change process.

In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insec

An issue in Oncord+ Android Infotainment Systems OS Android 12, Model Hardware TS17,Hardware part Number F57L_V3.2_20220

Netskope Client on Mac OS is impacted by a vulnerability in which the postinstall script does not properly validate the

Helix ALM prior to 2025.1 returns distinct error responses during authentication, allowing an attacker to determine whet

SQL injection vulnerability found in Enricozab CMS v.1.0 allows a remote attacker to execute arbitrary code via /hdo/hdo

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only t

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally.

This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when ex

The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send request

This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite lo

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into inclu

In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component

Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerab

Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerabili

Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerab

Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerab

cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.

Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system

The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in th

TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi.

A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially lea

This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. Th

The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. Th

The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner.

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/

CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=t

Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-bar

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers S

Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affe

Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Cross Site Request Forgery. This issue aff

Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Photography photography allows Server Side Request Forger