2025

The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ty

The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter i

The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘conte

The Prime Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up

The Cookie Notice Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_e

The WooCommerce Food - Restaurant Menu & Food ordering plugin for WordPress is vulnerable to arbitrary shortcode executi

The ravpage plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.31 via de

The Ultimate Classified Listings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to,

The Ultimate Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title paramet

The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to unauthorized m

The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to SQL Injection via the 'engtz_wd_save_

The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting v

The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the p

The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This i

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmwa

Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through

The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Sc

IBM OpenPages with Watson 8.3 and 9.0  could allow a remote attacker to spoof mail server identity when using SSL/TLS

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system.

IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enab

IBM OpenPages with Watson 8.3 and 9.0  application could allow an authenticated user to manipulate data in the Question

A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.

The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attacker

An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connecti

Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via

Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentiall

An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citri

An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citri

A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with W

The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functional

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses

The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (C

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauth

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-5

Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows.

GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path

An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_At

An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specific

An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_

Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom

Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2At

An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when proce

An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a net

Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a ne

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input befor

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it doe

Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but