2025

Discord-Bot-Framework-Kernel is a Discord bot framework built with interactions.py, featuring modular extension manageme

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in videowhisper Paid Videoc

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Confi

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified simplified allows Using Malicious F

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnens

Improper Restriction of Excessive Authentication Attempts vulnerability in Rameez Iqbal Real Estate Manager real-estate-

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Techspawn Distance

A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related mod

Incorrect Privilege Assignment vulnerability in SeventhQueen K Elements k-elements allows Privilege Escalation.This issu

A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERR

A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string

When reading the language .mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its

A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for

Vim is a greatly improved version of the good old UNIX editor Vi. Vim allows to redirect screen messages using the `:red

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be

Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are s

The ZOO-Project is an open source processing platform, released under MIT/X11 Licence. A vulnerability in ZOO-Project's

CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is ba

SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is base

Meshtastic is an open source mesh networking solution. In affected firmware versions crafted packets over MQTT are able

Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to sys

Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potential

A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bou

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.Acces

Webkul QloApps v1.6.1 exposes authentication tokens in URLs during redirection. When users access the admin panel or oth

smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner

Sage DPW before 2024_12_001 is vulnerable to Incorrect Access Control. The implemented role-based access controls are no

Sage DPW before 2024_12_000 is vulnerable to Cross Site Scripting (XSS). Low-privileged Sage users with employee role pr

An issue was discovered in Atos Eviden IDRA before 2.7.1. A highly trusted role (Config Admin) could leverage a race con

An issue was discovered in Fluent Bit 3.1.9. When the OpenTelemetry input plugin is running and listening on an IP addre

An issue was discovered in Fluent Bit 3.1.9. When the Prometheus Remote Write input plugin is running and listening on a

A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the perm

Foundry Artifacts was found to be vulnerable to a Denial Of Service attack due to disk being potentially filled up based

Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. A highly trusted role (Config Admin) could exceed their

The administrative web interface of a Netgear C7800 Router running firmware version 6.01.07 (and possibly others) authen

A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election Syste

Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of com_scheduler.

In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_

In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit

A vulnerability in the Netgear DGN2200 router with firmware version v1.0.0.46 and earlier permits unauthorized individua

A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including

Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that w

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. Thi

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Komtera Technolgies KLog

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in al

The PressMart - Modern Elementor WooCommerce WordPress Theme theme for WordPress is vulnerable to arbitrary shortcode ex