CVE-2025-1007

In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/namespace/details API allows a user to edit all namespace details, even if the user is not a namespace Owner or Contributor. The details include: name, description, website, support link and social media links. The same issues existed in...

CVE-2024-2281

A vulnerability was found in boyiddha Automated-Mess-Management-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/index.php of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated...

CVE-2024-2435

For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that signal. The XSS is in the timeline page displaying the workflow execution details of the workflow that was sent the crafted signal. Access...

CVE-2019-12936

BlueStacks App Player 2, 3, and 4 before 4.90 allows DNS Rebinding for attacks on exposed IPC functions...

Symfony Conflicting Headers Information Disclosure

The remote web application is using Symfony, a PHP framework. It is affected by an information disclosure vulnerability arising from conflicting proxy headers. When both 'Forwarded' and 'X-Forwarded-' headers are present in a request, a misconfiguration in Symfony's trusted proxy settings can...

PT-2026-2157

CVE-2026-22162 - Apache Struts Command Injection CVE ID : CVE-2026-22162 Published : Jan. 7, 2026, 12:17 p.m. | 3 hours, 59 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-21494

creationtimestamp| type| source ---|---|--- 2026-01-06 20:13:41+00:00| seen| Telegram/W9cnrPaYEkduQXNMxTamq0Dafu5VRSzGfTVZkSYwQLJrcs 2026-01-06 21:07:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbrubokt4e2q...

CVE-2024-31088

CVE-2024-31088 affects WordPress plugin AdsPlace’r – Ad Manager, Inserter, AdSense Ads (WPShop.Ru AdsPlace’r) up to version 1.1.5. Vulnerability is DOM-based XSS due to improper input handling during web page generation, enabling cross-site scripting within the context of a user’s browser. Public...

CVE-2025-63083 Joomla! Core - [20260102] - XSS vector in the pagebreak plugin

Lack of output escaping leads to a XSS vector in the pagebreak plugin...

CVE-2025-5919

CVE-2025-5919 affects the WordPress plugin “Appointment Booking Calendar – WP Timetics Booking Plugin.” The vulnerability stems from a missing capability check in the update and register_routes functions across versions up to 1.0.36, allowing unauthenticated attackers to view and modify booking d...

CVE-2025-5919 Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification

The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and registerroutes functions in all versions up to, and including, 1.0.36. This makes it possible...

WordPress Timetics plugin <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification vulnerability

Missing Authorization to Unauthenticated Booking Details View And Modification vulnerability discovered by greenhats - Student in WordPress Plugin Timetics versions = 1.0.36...

CVE-2024-30461

CVE-2024-30461 affects Tumult Hype Animations (WordPress plugin) up to version 1.9.11. The issue is an DOM-based XSS caused by improper input neutralization during web page generation, enabling script execution in the context of a user’s browser. Public sources consistently describe this as a Cro...

CGA-55P9-PG8C-WR5P

Bulletin has no description...

CVE-2025-15449 cld378632668 JavaMall MinioController.java delete path traversal

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

EUVD-2026-0921

A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/java/com/macro/mall/controller/MinioController.java. This manipulation of the argument objectName causes path traversal. The attack can be...

CVE-2025-15448

CVE-2025-15448 affects JavaMall (up to version 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0). The vulnerability is in the Upload function of MinioController.java (src/main/java/com/macro/mall/controller/MinioController.java), enabling unrestricted file uploads. Root cause and impact details are descr...

Android Automotive OS Update Bulletin—January 2026Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2026-01-05 or later from the January 2026 Android Security Bulletin in addition to all issues in thi...

PT-2026-1336

Name of the Vulnerable Software and Affected Versions Coolify versions up to and including 4.0.0-beta.434 Description Coolify is a self-hostable tool for managing servers, applications, and databases. An attacker can initiate a password reset for a victim and modify the host header of the request...

CVE-2026-0574

A weakness has been identified in yeqifu warehouse up to aaf29962ba407d22d991781de28796ee7b4670e4. This affects the function saveUserRole of the file warehouse\src\main\java\com\yeqifu\sys\controller\UserController.java of the component Request Handler. This manipulation causes improper...