2025

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1

The Astra Security Suite – Firewall & Malware Scan plugin for WordPress is vulnerable to arbitrary file uploads due to i

The EasyCommerce – AI-Powered, Fast & Beautiful WordPress Ecommerce Plugin plugin for WordPress is vulnerable to Privile

The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads i

The WP移行専用プラグイン for CPI plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation

The Mementor Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.5

The Include Fussball.de Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api' and 'typ

SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 da

SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could b

SAP S4CORE (Manage journal entries) does not perform necessary authorization checks for an authenticated user resulting

Due to information disclosure vulnerability in anonymous API provided by SAP Business One (SLD), an attacker with normal

Due to insufficient validation of connection property values, the SAP HANA JDBC Client allows a high-privilege locally a

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adja

Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL

Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative ac

SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended use

SAP Starter Solution allows an authenticated attacker to execute crafted database queries, thereby exposing the back-end

SAP GUI for Windows may allow a highly privileged user on the affected client PC to locally access sensitive information

Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when cal

Due to a Reflected Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could

Due to missing authentication, SAP HANA 2.0 (hdbrss) allows an unauthenticated attacker to call a remote-enabled functio

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL u

Migration Workbench (DX Workbench) in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic

In TEE EcDSA algorithm, there is a possible memory consistency issue. This could lead to generated incorrect signature r

SpiceDB is an open source database system for creating and managing security-critical application permissions. In versio

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In versions up to and including

An authenticated arbitrary file upload vulnerability in the /uploads/ endpoint of CMS Made Simple Foundation File Manage

An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allows DOM-based cross

A privilege escalation vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Enterprise

Employee Records System version 1.0 contains an unrestricted file upload vulnerability that allows a remote unauthentica

PacsOne Server version 6.6.2 (prior versions are likely affected) contains a directory traversal vulnerability within th

The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, valida

Milvus is an open-source vector database built for generative AI applications. An unauthenticated attacker can exploit a

Pdfminer.six is a community maintained fork of the original PDFMiner, a tool for extracting information from PDF documen

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.6, a specially crafted Brotli-compressed envelope

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" (highly compressed brotli strea

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incu

Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `exp

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and be

OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrat

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-sit

Improper input validation in OneFlow v0.9.0 allows attackers to cause a segmentation fault via adding a Python sequence

changedetection.io is a free open source web page change detection tool. A Stored Cross Site Scripting is present in cha