2025

A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from

An issue was discovered in BAE SOCET GXP before 4.6.0.2. Some endpoints on the SOCET GXP Job Status Service may return s

An issue was discovered in BAE SOCET GXP before 4.6.0.2. An attacker with the ability to interact with the GXP Job Servi

Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.

Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via

A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in

NVIDIA Display Driver for Windows and Linux contains a vulnerability in a video decoder, where an attacker might cause a

NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger

NVIDIA Display Driver for Linux contains a vulnerability where an attacker might be able to trigger a null pointer deref

NVIDIA Display Driver for Linux contains a vulnerability in the kernel driver, where a user could cause a null pointer d

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local

gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.ph

A stored cross-site scripting (XSS) vulnerability in the /manager/pages component of Piranha CMS v12.0 allows attackers

Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute ar

FontForge v20230101 was discovered to contain a memory leak via the utf7toutf8_copy function at /fontforge/sfd.c.

FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8.

Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue af

Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take

Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near t

CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding addi

A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the

Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA

A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600. Applications built wi

Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks. An unauthenticated attacker on the same l

Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET re

A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on

The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘a

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is

The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all ver

An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them m

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden g

A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certa

The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially

An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings

A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information fr

Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive u

A flaw was found in the course overview output function where user access permissions were not fully enforced. This coul

Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total. This issue allows an authenticated atta

Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS du

QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with adm

QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin p

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner S

Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page. If crafted in

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file path

Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page. If crafted input is stored b

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within t

Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Comm

Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated us

Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to e