2025

Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can us

Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml funct

The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in

A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected

Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability a

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerabilit

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerabilit

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability t

An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and t

Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a flaw in the installa

Omnissa Horizon Client for macOS contains a Local privilege escalation (LPE) Vulnerability due to a logic flaw. Successf

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of

In Ashlar-Vellum Cobalt versions prior to v12 SP2 Build (1204.200), the affected application lacks proper validation of

Improper Validation of Specified Type of Input vulnerability in OpenText™ Content Management (Extended ECM) allows Param

Discourse is an open source platform for community discussion. In affected versions users who disable chat in preference

Discourse is an open source platform for community discussion. In affected versions the endpoint for generating inline o

Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, a

The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrat

The "NagVis" component within Checkmk is vulnerable to reflected cross-site scripting. An attacker can craft a malicious

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a re

Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary Ja

Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' br

Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when th

Discourse is an open source platform for community discussion. In affected versions an attacker can make craft an XHR re

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensiti

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data i

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vul

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery whi

reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability al

reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability

reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application imprope

Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when acc

Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that res

AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an att

Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (L

A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with anoth

A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows rem

DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Co

woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF inv

Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who con

Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corru

Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap cor

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to Exter

A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unen

A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directori

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authe