2025

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xm

Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum

Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts

A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetPar

Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.

A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via

A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the de

Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lea

Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_d

Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass

Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*

OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 coul

Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /veh

Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to eleva

Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packe

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-pri

A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authen

Carbon Black Cloud Windows Sensor, prior to 4.0.3, may be susceptible to an Information Leak vulnerability, which s a ty

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. Thi

External XML entity injection allows arbitrary download of files. The score without least privilege principle violation

Path traversal may allow remote code execution using privileged account (requires device admin account, cannot be perfo

Path traversal may lead to arbitrary file deletion. The score without least privilege principle violation is as calcula

A SQL injection vulnerability in the Convert Forms component versions 1.0.0-1.0.0 - 4.4.9 for Joomla allows authenticate

Path traversal may lead to arbitrary file download. The score without least privilege principle violation is as calcula

Lucee Server (or simply Lucee) is a dynamic, Java based, tag and scripting language used for rapid web application devel

Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker

Insufficiently Protected Credentials vulnerability in OpenText Identity Manager Advanced Edition on Windows, Linux, 64 b

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Merkur Software B2

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informat

Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vuln

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi

The Spreadsheet Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and

The DesignThemes Core Features plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabi

The Sparkling theme for WordPress is vulnerable to unauthorized plugin activation/deactivation due to a missing capabili

An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid memo

The Homey theme for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.4.2. This is

The Homey Login Register plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including

The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin

Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP

The WP Real Estate Manager plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includ

The WooCommerce Recover Abandoned Cart plugin for WordPress is vulnerable to PHP Object Injection in all versions up to,

The WP Online Contract plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on th

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Featherlight.js Ja

The Staff Directory Plugin: Company Directory plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due t

The The Listingo theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including

The Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme theme for WordPress is vulnerable to unauthoriz

The Zass - WooCommerce Theme for Handmade Artists and Artisans theme for WordPress is vulnerable to unauthorized access

The Hero Slider - WordPress Slider Plugin plugin for WordPress is vulnerable to SQL Injection via several parameters in