2025

Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Author

Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arb

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certifi

Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vul

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a

Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticat

An issue in OneTrust SDK v.6.33.0 allows a local attacker to cause a denial of service via the Object.setPrototypeOf, __

A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This

A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by thi

A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected b

CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 ha

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affecte

A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Th

A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a

A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects a

URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and ser

A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as pro

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorre

An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled

An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that c

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or t

Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may caus

The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM E

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This af

A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Af

A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. Affected by this vu

Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacke

Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker wh

Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass co

Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit hea

A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions

Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has be

In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorize

Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 a

NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using t

In Netbox Community 4.1.7, once authenticated, Configuration History > Add`is vulnerable to cross-site scripting (XSS) d

In Netbox Community 4.1.7, the login page is vulnerable to cross-site scripting (XSS), which allows a privileged, authen

A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-q

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-de

PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/requ

A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. Affected by this vu

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_

A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the f

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking

When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing

When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was