BIT-NODE-MIN-2023-32006

The use of module.constructor.createRequire can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability affects all users using the experimental policy mechanism in all active release lines: 16.x, 18.x, and, 20.x. Please note th...

BIT-NODE-MIN-2023-32558

The use of the deprecated API process.binding can bypass the permission model through path traversal. This vulnerability affects all users using the experimental permission model in Node.js 20.x. Please note that at the time this CVE was issued, the permission model is an experimental feature of...

BIT-NODE-MIN-2023-38552

When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation and return a forged checksum to the node's policy implementation, thus effectively disabling the integrity check. Impacts: This vulnerability affects all user...

BIT-NODE-MIN-2024-21890

The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/. This misleading documentation affects all users...

BIT-NODE-MIN-2024-21896

The permission model protects itself against path traversal attacks by calling path.resolve on any paths given by the user. If the path is to be treated as a Buffer, the implementation uses Buffer.from to obtain a Buffer from the result of path.resolve. By monkey-patching Buffer internals, namely...

PT-2024-36303 · WordPress · Wp-Hidethat

Name of the Vulnerable Software and Affected Versions: WP-HideThat versions 1.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, potentiall...

PT-2024-36274 · Unknown · Phuc Pham Multiple Admin Emails

Name of the Vulnerable Software and Affected Versions: Phuc Pham Multiple Admin Emails versions n/a through 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This affects the multiple admin emails functionality...

PT-2024-36622 · Syncfusion · Syncfusion Essential Studio For Asp.Net Mvc

Name of the Vulnerable Software and Affected Versions: Syncfusion Essential Studio for ASP.NET MVC versions prior to 27.1.55 Description: The issue occurs when resaving a DOCX document with an external reference XML, resulting in an XMLException. This problem is present in the DocIO feature of...

CVE-2024-55946

Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...

CVE-2024-55946

Summary (CVE-2024-55946): Playloom Engine (Engine Beta v0.0.1) has a data-storage privacy vulnerability in collaboration features, risking exposure of personal information entered by users when collaborating with others. The issue is being addressed by temporarily disabling the collaboration feat...

CVE-2024-55946 Playloom Engine Data Storage Vulnerability

Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...

CVE-2024-55946 Playloom Engine Data Storage Vulnerability

Playloom Engine is an open-source, high-performance game development engine. Engine Beta v0.0.1 has a security vulnerability related to data storage, specifically when using the collaboration features. When collaborating with another user, they may have access to personal information you have...

CVE-2024-10783 MainWP Child <= 5.2 - Missing Authorization to Unauthenticated Privilege Escalation

The MainWP Child – Securely Connects to the MainWP Dashboard to Manage Multiple Sites plugin for WordPress is vulnerable to privilege escalation due to a missing authorization checks on the registersite function in all versions up to, and including, 5.2 when a site is left in an unconfigured stat...

CVE-2024-10783

CVE-2024-10783 – MainWP Child (WordPress) Root cause: missing authorization checks in register_site in all versions up to 5.2 when a site is unconfigured, enabling an unauthenticated user to login as an administrator on instances not yet connected to the MainWP Dashboard and without the unique se...

Remote Code Execution (RCE)

Joplin is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient sanitization of tag attributes introduced by the Mermaid feature, allowing execution of untrusted HTML content within the Electron window...

Playloom Engine information leakage vulnerability

Playloom Engine is an open source, high-performance game development engine from Quetro Personal Developers. It is designed to help developers create immersive 2D and 3D games. An information disclosure vulnerability exists in Playloom Engine version v0.0.1. The vulnerability stems from the...

Adobe Connect Access Control Error Vulnerability (CNVD-2025-02843)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. Adobe Connect has an Access Control Error vulnerability that stems from the inclusion of an improper access control. An attacker could exploit the vulnerability to cause a security feature bypas...

Adobe Experience Manager Access Control Error Vulnerability (CNVD-2025-16241)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. An access...

Adobe Experience Manager Input Validation Error Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. An inp...

Adobe Experience Manager Authorization Issues Vulnerability (CNVD-2025-16238)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. Adobe...