2025

A stored cross-site scripting (XSS) vulnerability in AIxBlock commit 04f305 allows attackers to execute arbitrary web sc

An arbitrary file upload vulnerability in the Data Preparation function of AIxBlock commit f60975 allows attackers to ex

PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttac

Dell Secure Connect Gateway (SCG) 5.0 Application and Appliance version(s) 5.26.00.00 - 5.30.00.00, contain a Relative P

Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutra

Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.

Zohocorp ManageEngine Exchange Reporter Plus versions before 5723 are vulnerable to Stored Cross Site Scripting in the r

Zohocorp ManageEngine Exchange Reporter Plus versions through 5721 are vulnerable to Stored Cross Site Scripting in the

Zohocorp ManageEngine Exchange Reporter Plus through 5721 are vulnerable to ReDOS vulnerability in the search module.

Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allo

An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause t

A SQL injection vulnerability exists in CSZ-CMS <=1.3.0 in the Form Builder view functionality. The vulnerability is loc

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server w

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was repla

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to unauthorized access of data due to a missing

The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log

The Translate WordPress and go Multilingual – Weglot plugin for WordPress is vulnerable to unauthorized loss of data due

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blocksy_newsle

Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Lifera

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects

Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Co

Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible t

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field

The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the n

When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols

Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By s

Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion.

tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A mal

Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgra

On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user

On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) mult

The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component

Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebR

memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (

Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote atta

Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an aut

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4,

An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 a

SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4,

A vulnerability has been identified in Rancher Manager, where sensitive information, including secret data, cluster imp

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives admini

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read per

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attacker

A missing permission check in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers with Overall/Read per