2025

An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user accoun

Cursor is a code editor built for programming with AI. In versions 1.7 and below, a vulnerability in the way Cursor CLI

Cursor is a code editor built for programming with AI. In versions 1.7 and below, automatic loading of project-specific

HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the exec

Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user

An SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, the

Cursor is a code editor built for programming with AI. In versions 1.7 and below, when MCP uses OAuth authentication wit

Cursor is a code editor built for programming with AI. Versions 1.6 and below are vulnerable to Remote Code Execution (R

An issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and replace the legitimate lo

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name

A TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a remote, unauthenticated Deni

Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loadi

The AP Background plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization and insuffic

The TextBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 1.0.0 to 1.1.1. This is due

The WP Dispatcher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in th

The Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App plugin for WordPress is vulnerable to SQ

The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSourc

Installer of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL search path, which may lead

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored

Claude Code is an agentic coding tool. Versions before 1.0.111 were vulnerable to Code Injection due to a bug in the sta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Delta Electronics DIAScreen lacks proper validation of the user-supplied file. If a user opens a malicious file, an atta

Stalwart is a mail and collaboration server. Versions 0.13.3 and below contain an unbounded memory allocation vulnerabil

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-S

An unauthenticated debug port may allow access to the device file system.

The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.

The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficient

SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan f

Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flck

The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and S

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA/SaaS deployments) store user passwords u

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWan

Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan func

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment

Vulnerability in the cryptographic algorithm of AndSoft's e-TMS v25.03, which uses MD5 to encrypt passwords. MD5 is a cr

Path traversal vulnerability in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to access files only withi

TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary cod

An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker

A vulnerability has been identified within Rancher Manager whereby the SAML authentication from the Rancher CLI tool is

A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` fie

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5

Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin. This issue affects Apache Kylin

Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions