2025

Unsafe password recovery from configuration in M-Files Server before 25.1 allows a highly privileged user to recover ext

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payl

The Product Table by WBW plugin for WordPress is vulnerable to SQL Injection via the 'additionalCondition' parameter in

The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Post Slider and Ecommerce Slider) plugin f

The BMLT Meeting Map plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.

The Variation Swatches for WooCommerce plugin, in all versions starting at 1.0.8 up until 1.3.2, contains a vulnerabilit

A file handling command vulnerability in certain versions of Armoury Crate may result in arbitrary file deletion. Refer

The request handling in the core in Apache Wicket 7.0.0 on any platform allows an attacker to create a DOS via multiple

An issue was identified in Fleet Server where Fleet policies that could contain sensitive information were logged on INF

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted requ

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the check tables fe

An issue was discovered in phpMyAdmin 5.x before 5.2.2. An XSS vulnerability has been discovered for the Insert tab.

A server side request forgery vulnerability was identified in Kibana where the /api/fleet/health_check API could be used

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contai

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway

BigFix Patch Download Plug-ins are affected by path traversal vulnerability. The application could allow operators to d

BigFix Patch Download Plug-ins are affected by an insecure protocol support. The application can allow improper handlin

BigFix Patch Download Plug-ins are affected by an insecure package which is susceptible to XML injection attacks. This

BigFix Patch Download Plug-ins are affected by insecure support for file URI scheme. It could allow a malicious operato

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulne

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerabilit

BigFix Patch Download Plug-ins are affected by an arbitrary file download vulnerability. It could allow a malicious ope

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component gray_record_cell.

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component composition_source_over.

lunasvg v3.0.0 was discovered to contain a allocation-size-too-big bug via the component plutovg_surface_create.

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_path_add_path.

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component plutovg_blend.

lunasvg v3.0.0 was discovered to contain a segmentation violation via the component blend_transformed_tiled_argb.isra.0.

BigFix Patch Download Plug-ins are affected by Server-Side Request Forgery (SSRF) vulnerability. It may allow the appli

The Avada Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all v

A Cross Site Request Forgery (CSRF) vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to

Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silver

Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially expl

Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap c

D-Link DSL-3782 v1.01 is vulnerable to Buffer Overflow in /New_GUI/ParentalControl.asp.

By utilizing software-defined radios and a custom low-latency processing pipeline, RF signals with spoofed location data

For TCAS II systems using transponders compliant with MOPS earlier than RTCA DO-181F, an attacker can impersonate a grou

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-C

Improper Privilege Management vulnerability in Cloudflare WARP on Windows allows File Manipulation. User with a low sys

In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1

A missing permission check in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attackers with Overall/Read per

A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Service Fabric Plugin 1.6 and earlier allows attacker

Jenkins Folder-based Authorization Strategy Plugin 217.vd5b_18537403e and earlier does not verify that permissions confi

Jenkins Eiffel Broadcaster Plugin 2.8.0 through 2.10.2 (both inclusive) uses the credential ID as the cache key during s

Jenkins OpenId Connect Authentication Plugin 4.452.v2849b_d3945fa_ and earlier, except 4.438.440.v3f5f201de5dc, treats u

Jenkins Bitbucket Server Integration Plugin 2.1.0 through 4.1.3 (both inclusive) allows attackers to craft URLs that wou

An incorrect permission check in Jenkins GitLab Plugin 1.9.6 and earlier allows attackers with global Item/Configure per

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerabi

A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to h

A vulnerability in the REST API of Cisco Meeting Management could allow a remote, authenticated attacker with low privil