2025

Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions bef

A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the

A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions.

A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of

A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Co

Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in

Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users

A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12.

open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tas

An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authentic

A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings,

A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.

A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.

A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.

A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec22

Improper control of dynamically-managed code resources vulnerability in WebAPI component in Synology DiskStation Manager

A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind

Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to u

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac

A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attac

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sen

The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,

The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions u

The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` param

The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and

MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is

Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, the

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality all

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive inte

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive inte

An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certifi

Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db364

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS ce

An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code vi

Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote atta

When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_ca

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy crashes w

The Aquarius HelperTool (1.0.003) privileged XPC service on macOS contains multiple flaws that allow local privilege esc

Aquarius Desktop 3.0.069 for macOS stores user authentication credentials in the local file ~/Library/Application Suppor

A local privilege escalation vulnerability exists in the Plugin Alliance InstallationHelper service included with Plugin

A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Instal

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 2100, 1280, 220

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and versions below 3.9.10, 3.8.58 and 3.7.28 of th

In Splunk Enterprise versions below 10.0.1, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507

In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and below 3.9.10, 3.8.58, and 3.7.28 of Splunk Sec

In Splunk MCP Server app versions below 0.2.4, a user with access to the "run_splunk_query" Model Context Protocol (MCP)

Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a loc

A stored cross-site scripting (XSS) vulnerability in the PwdGrp.cgi endpoint of AVTECH SECURITY Corporation DGM1104 Full

AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injec