2025

An Insecure Direct Object Reference (IDOR) in the /dashboard/notes endpoint of Syaqui Collegetivity v1.0.0 allows attack

Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allow

LiquidFiles filetransfer server is vulnerable to a user enumeration issue in its password reset functionality. The appli

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause

There is a memory corruption vulnerability due to an out of bounds read in DefaultFontOptions() when using SymbolEditor

There is a memory corruption vulnerability due to an out of bounds write in XML_Serialize() when using SymbolEditor in N

An issue in finance.js v.4.1.0 allows a remote attacker to cause a denial of service via the seekZero() parameter.

Finance.js v4.1.0 contains a Denial of Service (DoS) vulnerability via the IRR function’s depth parameter. Improper hand

Local privilege escalation due to insecure XPC service configuration. The following products are affected: Acronis True

An issue was discovered in Chipsalliance Rocket-Chip commit f517abbf41abb65cea37421d3559f9739efd00a9 (2025-01-29) allowi

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis True Image (

Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an ou

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 143.0.3.

Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 143.

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to,

The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

The AffiliateWP plugin for WordPress is vulnerable to SQL Injection via the ajax_get_affiliate_id_from_login function in

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQ

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQ

PAD CMS improperly initializes parameter used for password recovery, which allows to change password for any user that d

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification with

Multiple versions of Central Monitor CNS-6201 contain a NULL pointer dereference vulnerability. When processing a crafte

Insecure Direct Object Reference (IDOR) vulnerability in BOLD Workplanner in versions prior to 2.5.25 (4935b438f9b), con

This affects all versions of the package node-static; all versions of the package @nubosoftware/node-static. The package

go-f3 is a Golang implementation of Fast Finality for Filecoin (F3). In versions 0.8.6 and below, go-f3 panics when it v

Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.10

IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbitrary comma

libvips is a demand-driven, horizontally threaded image processing library. For versions 8.17.1 and below, when libvips

FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below expose information about feeds and tags of d

Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Pr

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 2

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 2

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 2

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 2

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 2

Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to 22.0.862 and Application prior to 20.0.2014 (VA and

Medical Informatics Engineering Enterprise Health has a cross site request forgery vulnerability that allows an unauthen

A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile fi

Description: VMware NSX contains a username enumeration vulnerability. An unauthenticated malicious actor may exploit th

VMware NSX contains a weak password recovery mechanism vulnerability. An unauthenticated malicious actor may exploit thi

A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary

VMware vCenter contains an SMTP header injection vulnerability. A malicious actor with non-administrative privileges on

A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attac

AT_NA2000 from Nanda Automation Technology vendor has a denial-of-service vulnerability. For the processing of TCP RST p

Openindiana, kernel SunOS 5.11 has a denial of service vulnerability. For the processing of TCP packets with RST or SYN

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially cr

VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with

An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP pa

VMware Tools for Windows contains an improper authorisation vulnerability due to the way it handles user access controls