2025

In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows u

Kaspersky has fixed a security issue in Kaspersky Anti-Virus SDK for Windows, Kaspersky Security for Virtualization Ligh

Tiny File Manager v2.4.7 and below is vulnerable to session fixation.

Tiny File Manager v2.4.7 and below was discovered to contain a Cross Site Scripting (XSS) vulnerability. This vulnerabil

Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to

Honeywell OneWireless Wireless Device Manager (WDM) for the following versions R310.x, R320.x, R321.x, R322.1, R322.2,

The Lite UI of Apache ShardingSphere ElasticJob-UI allows an attacker to perform RCE by constructing a special JDBC URL

A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability co

A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout

In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly,

Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this v

Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause fe

Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerabi

Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause

Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may caus

Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vul

Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability

Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect se

Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability

Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitra

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded mem

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from bot

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal

Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home

NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker

Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier

Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier

Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an atta

The The CURCY – Multi Currency for WooCommerce – The best free currency exchange plugin – Run smoothly on WooCommerce 9.

The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well

Use of Hard-coded Credentials vulnerability in ABB ASPECT-Enterprise, ABB NEXUS Series, ABB MATRIX Series.This issue aff

IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user t

IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary com

IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their pr

OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campai

IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user.

IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message i

IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable

IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to vi

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau

IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unau

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitra

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log f

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows auth

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authe

IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authe