2025

Denial-of-analysis in reporting/mongodb.py and reporting/jsondump.py in CAPEv2 (commit 52e4b43, on 2025-05-17) allows at

SQL Injection vulnerability in opentext Flipper allows SQL Injection.  The vulnerability could allow a low privilege us

Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Ac

Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0.

An issue in Senayan Library Management System (SLiMS) 9 Bulian v.9.6.1 allows a remote attacker to execute arbitrary cod

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In version 1.4.0

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to version

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Pro

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Ti

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Ti

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB CoreSense™ HM, ABB C

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 #147, ClipBucket v5 is vulnerable to arbi

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix warning in smc_rx_splice() when callin

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 210

An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 210

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 128

Cross-Site Scripting (XSS) vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/media_manager component. Att

Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide cus

An arbitrary code execution vulnerability exists in the git functionality of Truffle Security Co. TruffleHog 3.90.2. A s

A lack of rate limiting in the One-Time Password (OTP) verification endpoint of SigningHub v8.6.8 allows attackers to by

A lack of rate limiting in the component /Home/UploadStreamDocument of SigningHub v8.6.8 allows attackers to cause a Den

Incorrect access control in SigningHub v8.6.8 allows attackers to arbitrarily add user accounts without any rate limitin

ETERNUS SF provided by Fsas Technologies Inc. contains an incorrect default permissions vulnerability. A low-privileged

A vulnerability has been found in 70mai X200 up to 20251010. Affected by this vulnerability is an unknown functionality

A flaw has been found in 70mai X200 up to 20251010. Affected is an unknown function of the component Pairing. Executing

A security vulnerability has been detected in LibreWolf up to 143.0.4-1 on Windows. This affects an unknown function of

Apache Geode is vulnerable to CSRF attacks through GET requests to the Management and Monitoring REST API that could all

The Theme Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,

A vulnerability has been found in Nixdorf Wincor PORT IO Driver up to 1.0.0.1. This affects the function sub_11100 in th

The PPOM – Product Addons & Custom Fields for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the PP

The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and inclu

The 10WebMapBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Plugin Settings Change in vers

The Restaurant Brands International (RBI) assistant platform through 2025-09-06 relies on client-side authentication for

DataEase is an open source data visualization and analytics platform. In versions 2.10.13 and earlier, the /de2api/datas

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC driver bypass vuln

DataEase is a data visualization and analytics platform. In DataEase versions through 2.10.13, a JDBC URL injection vuln

A path traversal vulnerability in all versions of the Qodo Qodo Gen IDE enables a threat actor to read arbitrary local f

OpenBao is an open source identity-based secrets management system. In OpenBao versions prior to 2.4.1, JSON objects aft

In NextX Duo before 6.4.4, in the HTTP client module, the network support code for Eclipse Foundation ThreadX, the parsi

In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bou

In NextX Duo's snmp addon versions before 6.4.4, a part of the Eclipse Foundation ThreadX, an attacker could cause an ou

Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remot

Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers t

MinIO is a high-performance object storage system. In all versions prior to RELEASE.2025-10-15T17-29-55Z, a privilege es

A vulnerability was identified in NucleoidAI Nucleoid up to 0.7.10. The impacted element is the function extension.apply

MAS (Matrix Authentication Service) is a user management and authentication service for Matrix homeservers, written and

Bagisto is an open source laravel eCommerce platform. When product data that begins with a spreadsheet formula character

An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (

The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updat