2025

Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specia

In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from

An issue in keras 3.7.0 allows attackers to write arbitrary files to the user's machine via downloading a crafted tar fi

A vulnerability was found in Kingsoft WPS Office 6.14.0 on macOS. It has been declared as critical. Affected by this vul

Pingvin Share is a self-hosted file sharing platform and an alternative for WeTransfer. This vulnerability allows an aut

Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.217 , Tabby enables several high-risk

Soft Serve is a self-hostable Git server for the command line. Prior to 0.8.2 , a path traversal attack allows existing

A vulnerability in certification validation routines of Cisco ThousandEyes Endpoint Agent for macOS and RoomOS could all

Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an auth

RedisBloom adds a set of probabilistic data structures to Redis. There is an integer overflow vulnerability in RedisBloo

An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5. Input passed through the

RediSearch is a Redis module that provides querying, secondary indexing, and full-text search for Redis. An authenticate

RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYIND

Dell VxRail, versions 7.0.000 through 7.0.532, contain(s) a Plaintext Storage of a Password vulnerability. A high privil

The Shipping via Planzer for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘p

The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline set

The Ultimate Gift Cards for WooCommerce – Create WooCommerce Gift Cards, Gift Vouchers, Redeem & Manage Digital Gift Cou

The Garden Gnome Package plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio

The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validatio

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to unauthorized modification of data due to a mis

The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.2

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Def

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Pro

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The MinigameCenter module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on

The MAS Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions

The Cost Calculator Builder PRO plugin for WordPress is vulnerable to blind time-based SQL Injection via the ‘data’ para

The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i

The health module has insufficient restrictions on loading URLs, which may lead to some information leakage.

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includi

VMware Aria Automation contains a server-side request forgery (SSRF) vulnerability. A malicious actor with "Organization

A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unk

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ha_cmc_text' p

The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for

The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Sensitive Information Exposure

The WordPress File Upload plugin for WordPress is vulnerable to Remote Code Execution, Arbitrary File Read, and Arbitrar

The Property Hive WordPress plugin before 2.1.1 does not sanitise and escape a parameter before outputting it back in th

The InfiniteWP Client plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.13.0

The Auto iFrame WordPress plugin before 2.0 does not validate and escape some of its shortcode attributes before outputt

cpdf through 2.8 allows stack consumption via a crafted PDF document.

The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the TF E Slide

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'key' attribute o

The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to modification of data due to a missing

The WordPress Webinar Plugin – WebinarPress plugin for WordPress is vulnerable to arbitrary file creation due to a missi