2025

ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 discl

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through

Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs

Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XS

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async,

Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automat

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and

Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool exe

Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.1

ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the T

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) int

XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-mi

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, speci

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and

NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in

Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hu

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented r

Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with r

Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certi

Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server c

Chyrp 2.5.2 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scr

PopojiCMS 2.0.1 contains an authenticated remote command execution vulnerability that allows administrative users to inj

WBCE CMS version 1.6.2 contains a remote code execution vulnerability that allows authenticated attackers to upload mali

Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload mali

Dotclear 2.29 contains a remote code execution vulnerability that allows authenticated attackers to upload malicious PHP

CMSimple 5.15 contains a remote command execution vulnerability that allows authenticated attackers to modify file exten

appRain CMF 4.0.5 contains an authenticated remote code execution vulnerability that allows administrative users to uplo

Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to exploit weak session manag

Screen SFT DAB 1.9.3 contains an authentication bypass vulnerability that allows attackers to change user passwords by e

External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to co

Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated u

WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged

The mobile application insecurely handles information stored within memory. By performing a memory dump on the applicati

The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hash

Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adv

The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure B

An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over

The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retri

The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet devi

An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmw

The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was d

The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on

As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash fro

An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mob