7801 matches found
Prototype Pollution
Overview rollbar is an Effortlessly track and debug errors in your JavaScript applications with Rollbar. This package includes advanced error tracking features and an intuitive interface to help you identify and fix issues more quickly. Affected versions of this package are vulnerable to Prototyp...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the SideroLink connection. An attacker can send arbitrary packets over the interface by exploiting the lack of validation on the packet's destination address. Workaround Users who are not able to upgrade to t...
CVE-2025-48868 Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive
Horilla is a free and open source Human Resource Management System HRMS. An authenticated Remote Code Execution RCE vulnerability exists in Horilla 1.3.0 due to the unsafe use of Python’s eval function on a user-controlled query parameter in the projectbulkarchive view. This allows privileged use...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the dochecksummathliveplay function in the tcpliveplay utility. An attacker can cause the application to crash or behave unexpectedly by submitting a specially crafted pcap file that triggers improper memo...
WordPress Super Blank Plugin <= 1.2.0 - Arbitrary Content Deletion Vulnerability
Arbitrary Content Deletion Vulnerability discovered by Denver Jackson in WordPress Plugin Super Blank versions = 1.2.0...
WordPress WP Ticket Customer Service Software & Support Ticket System plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin WP Ticket Customer Service Software & Support Ticket System versions = 6.0.0...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free via the parsejobsini function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input to this process. Remediation There is no fixed version for axboe/fio...
WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Legion Hunter in WordPress Plugin Payrexx Payment Gateway for WooCommerce versions = 3.1.5...
WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability
Arbitrary Content Deletion Vulnerability discovered by Denver Jackson in WordPress Plugin Ibtana versions = 1.2.5.3...
WordPress Soledad Theme <= 8.6.8 is vulnerable to Cross Site Scripting (XSS)
Software Soledad Type Theme Vulnerable versions = 8.6.8 Fixed in 8.6.9 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-59589 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 129327b97bb0 Credits João Pedro S Alcântara Kinorth Required privile...
CVE-2025-59427
The Cloudflare Vite plugin enables a full-featured integration between Vite and the Workers runtime. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain secret information such as...
DEBIAN-CVE-2025-59431
MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably to Boolean-based SQL injection. It seems like expression checking is bypassed by introducing double quote characters in the PropertyName. Allowing to manipula...
CVE-2025-35434
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2...
DoS (Denial of Service) Third-Party Dependency in Confluence Data Center and Server - CVE-2025-22166
This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...
CVE-2025-10630 Regex DoS in Grafana Zabbix Plugin
Grafana is an open-source platform for monitoring and observability. Grafana-Zabbix is a plugin for Grafana allowing to visualize monitoring data from Zabbix and create dashboards for analyzing metrics and realtime monitoring. Versions 5.2.1 and below contained a ReDoS vulnerability via...
Access of Resource Using Incompatible Type ('Type Confusion')
Overview @digitalocean/do-markdownit is a Markdown-It plugin for the DigitalOcean Community. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the callout and fenceenvironment plugins when allowedClasses or allowedEnvironments is...
CVE-2025-59040
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Backlog item representations do not verify the permissions of the child trackers. Users might see tracker names they should not have access to. This vulnerability is fixed in Tuleap Community Edition...
CVE-2025-59417 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting XSS vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. In lobe-chat, when the response from the...
DoS vulnerability in REXML
REXML has a DoS condition when parsing malformed XML file REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXM...