HIGH Severity CVEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader El

Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.

Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object Injection.This issue a

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonste

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud ChatB

A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the function getInterna

A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affects the function sub

A flaw was found in the vllm-orchestrator-gateway component. The system's production binary logs all incoming authorizat

A vulnerability was identified in Shibby Tomato up to 1.28.0000. Affected by this vulnerability is the function main of

A vulnerability was determined in Shibby Tomato up to 1.28.0000. Affected is the function getupsvar of the file www/apcu

A vulnerability was found in Tenda CH22 1.0.0.1. This impacts the function formCertListInfo of the file /goform/CertList

A vulnerability has been found in will-moss Isaiah up to 1.36.9. This affects an unknown function of the file app/main.g

A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file a

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through

A security flaw has been discovered in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown c

The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter befor

The Tutor LMS WordPress plugin before 3.9.13 does not, in its Droip and Kirki page-builder integration, perform the enr

The User Registration & Membership WordPress plugin before 5.2.2 does not perform an authorization check on a membershi

The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an

Successful exploitation of the integer overflow vulnerability could allow an attacker to achieve system-level access to

A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSumma

A security vulnerability has been detected in Tencent PC Manager 18.1.30242.301. This issue affects some unknown process

A weakness has been identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This vulnerability affects the function RPCS

A security vulnerability has been detected in SecureAge CatchPulse up to 10.9.3. The affected element is an unknown func

Zephyr's dynamic kernel-object tracking (kernel/userspace/userspace.c, formerly kernel/userspace.c) maintains a doubly-l

parse_ipv4() in subsys/net/ip/utils.c (reached via net_ipaddr_parse() for strings of the form "a.b.c.d:port") copies the

In Zephyr's WireGuard subsystem (subsys/net/lib/wireguard), wg_process_data_message() in wg_crypto.c linearizes an inbou

Untrusted pointer dereference in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges o

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent networ

luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject Jav

OpenWrt luci-app-samba4 read ACL grants file.exec permission on /usr/sbin/smbd, allowing authenticated delegated users t

Capgo before 12.128.2 contains a cross-organization account disruption vulnerability in the SSO prelink endpoint that al

Capgo before 12.128.2 allows email address changes without requiring current password re-authentication or verification

Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to

Capgo before 12.128.2 contains a privilege escalation vulnerability where demoted super_admin users retain access to del

Capgo before 12.128.2 contains an information disclosure vulnerability in the Supabase PostgREST global_stats endpoint t

A vulnerability was identified in sergomanov SmartHomeAdatum up to cf495353d81b680675eb8d9aa14a318aa45ce12c. This impact

A vulnerability was determined in SonicCloudOrg sonic-agent up to 2.7.2. This affects an unknown function of the file so

A weakness has been identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. This affects

A security flaw has been discovered in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected

A vulnerability was identified in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected by t

A vulnerability was determined in hcr707305003 shiroiAdmin 1.1/1.3. Affected is the function FileController::upload of t

A vulnerability was detected in TRENDnet TEW-821DAP 1.12B01. The affected element is the function sub_41EC14 of the file

A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function sub_41EC14 of the fi

A weakness has been identified in Aster Telecom Azcall 10/11. This issue affects some unknown processing of the file /az

A security flaw has been discovered in Trendnet TEW-635BRM up to 1.00.03. This vulnerability affects the function ipoa_t

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function start_httpd of the file /

A vulnerability was found in H3C NX15 V100R017. Affected by this vulnerability is the function change_passwd of the file

Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code ove