2025

A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is re

In Genivia gSOAP with a specific configuration an unauthenticated remote attacker can generate a high CPU load when forc

The Event Registration Calendar By vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugi

Stack-based buffer overflow vulnerability exists in Linux Ratfor 1.06 and earlier. When the software processes a file wh

The ViewMedica 9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewmedica' shortco

Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NO

Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabil

Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could p

In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Auth

The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_condition' parameter

Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in th

A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.

A stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys E5600 Router Ver. 1.1.0.

MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table

MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table

MSFM before 2025.01.01 was discovered to contain a fastjson deserialization vulnerability via the component system/table

MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.

An arbitrary file upload vulnerability in the parserXML() method of JeeWMS before v2025.01.01 allows attackers to execut

JeeWMS before v2025.01.01 was discovered to contain a SQL injection vulnerability via the ReportId parameter at /core/CG

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.c

Tenda i24 V2.0.0.5 is vulnerable to Buffer Overflow in the addWifiMacFilter function.

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address edit

Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.

Discourse AI is a Discourse plugin which provides a number of AI features. When sharing Discourse AI Bot conversations i

Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. In some cases, form messages can contain HT

silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functional

ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vuln

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 5G wireless netw

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the AP configuration

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the mac address upda

H3C N12 V100R005 contains a buffer overflow vulnerability due to the lack of length verification in the 2.4G wireless ne

The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious cod

The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly forma

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actio

The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and en

An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. The attacke

A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their

A potential buffer overflow vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could al

A potential TOCTOU vulnerability was reported in PC Manager, Lenovo Browser, and Lenovo App Store that could allow a loc

IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface.

IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a netw

Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could r

Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result

Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could r

Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result

Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user in

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user in