CWE-345

The Kirki WordPress plugin before 6.0.12 does not sanitise or escape the email subject and body values supplied in a re

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, no

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 a

OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4,

The Nexter Blocks WordPress plugin before 5.0.2 does not restrict who can save global CSS through one of its REST endpo

A vulnerability was detected in Cesanta Mongoose up to 7.20. This impacts the function mg_chacha20_poly1305_decrypt of t

A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend

A vulnerability was determined in mkj Dropbear up to 2025.89. Impacted is the function unpackneg of the file src/curve25

A vulnerability was detected in PuTTY 0.83. Affected is the function eddsa_verify of the file crypto/ecc-ssh.c of the co

A security vulnerability has been detected in Cesanta Mongoose up to 7.20. This issue affects the function mg_aes_gcm_de

A weakness has been identified in TRENDnet TEW-821DAP 1.12B01. This issue affects the function find_hwid/new_gui_update_

A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_do_upgrade_cameo_dev

A security flaw has been discovered in Dolibarr ERP CRM up to 23.0.2. This vulnerability affects the function dol_verify

A flaw has been found in Insta InstaKNXServiceApp 1.2.3.1469. Affected by this issue is the function CreateWebClientAndD

The Estatik Real Estate Plugin WordPress plugin before 4.3.4 does not validate the same recipient list that it later use

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before usi

Flux notification-controller is the event forwarder and notification dispatcher for the GitOps Toolkit controllers. Prio

A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the fil

A flaw has been found in janmojzis tinyssh up to 20250501. Impacted is an unknown function of the file tinyssh/crypto_si

HCL AION is affected by a vulnerability where model packaging and distribution mechanisms may not include sufficient aut

When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded

Roadiz is a polymorphic content management system based on a node system. Prior to versions 2.3.43, 2.5.45, 2.6.31, and

Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pp

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unau

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is

Plonky3 is a toolkit for polynomial IOPs (PIOPs). Prior to versions 0.4.3 and 0.5.3, an attacker controlling prover-side

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebS

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endp

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute fo

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standar

Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baile

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, header signature verification cou

Insufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: H

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-ban

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortc

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token valid

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append att

Insufficient Verification of Data Authenticity vulnerability in dropbox samly allows an attacker to establish an authent

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM (`int

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's cluster replic

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allow

picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag

Thunderbird ignored paths when checking the validity of navigations in a frame. This vulnerability was fixed in Firefox

Unauthenticated Arbitrary File Upload (upgrade_contents.php) in DB Electronica Telecomunicazioni S.p.A. Mozart FM Transm

Formbricks is an open source qualtrics alternative. Prior to version 4.0.1, Formbricks is missing JWT signature verifica