CVE-2021-25262

Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack...

WordPress plugin HD Quiz 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Bullfrog 安全漏洞

Bullfrog is a simple plug-and-play Github tool open-sourced by Bullfrog Security. A security vulnerability exists in Bullfrog versions prior to 0.8.4, which stems from improper use of TCP leading to DNS data exfiltration that may bypass sandbox restrictions...

PT-2025-17525 · Mojoomla · Wpams

Name of the Vulnerable Software and Affected Versions: WPAMS versions prior to 44.0 Description: The issue affects WPAMS, allowing for Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site scripting. Recommendations: For versions prior to...

B&R Industrial Automation B&R APROL 代码问题漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation of Austria. A code issue vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-00P5, which stems from a server-side request forgery in the APROL Web Portal, which could allow...

B&R Industrial Automation B&R APROL 安全漏洞

B&R Industrial Automation B&R APROL is a process control system from B&R Industrial Automation, Austria. A security vulnerability exists in B&R Industrial Automation B&R APROL versions prior to 4.4-00P5, which stems from the exposure of sensitive system information by the SNMP component, which...

yimioa 安全漏洞

yimioa CloudNet OA is a locally deployed OA software by rabbit individual developers. A security vulnerability exists in versions prior to yimioa v2024.07.04, which stems from improper access control of the WebSecurityConfig component and allows an unauthorized attacker to arbitrarily change the...

CVE-2025-20920

Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory...

SUSE CVE-2025-27154

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...

AZL-57327 CVE-2025-26598 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...

Vim 资源管理错误漏洞

Vim is a cross-platform text editor open-sourced by Vim. A resource management error vulnerability exists in Vim versions prior to 9.1.1115, which stems from memory reuse after release...

PT-2025-7078

Name of the Vulnerable Software and Affected Versions: Home Assistant Core versions prior to 2024.1.6 Description: The issue concerns a potential man-in-the-middle attack due to missing SSL certificate verification in the project codebase and used third-party libraries. In the past,...

CVE-2022-4609

Cross-site Scripting XSS - Stored in GitHub repository usememos/memos prior to 0.9.0...

UBUNTU-CVE-2025-1018

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135...

PT-2025-5394 · Unknown · Alexandros Georgiou Bitcoin/Altcoin Wallets

Name of the Vulnerable Software and Affected Versions: Alexandros Georgiou Bitcoin and Altcoin Wallets versions prior to 6.3.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS attacks, specifically Reflecte...

JFinalOA 安全漏洞

JFinalOA is an enterprise office system developed on the JFinal framework by rabbit individual developers. A security vulnerability exists in JFinalOA versions prior to v2025.01.01. An attacker exploiting this vulnerability could execute arbitrary web script or HTML via a specially crafted payloa...

WordPress plugin Cookie Consent & Autoblock for GDPR/CCPA 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forgery...

iocharger 安全漏洞

iocharger is an electric vehicle charging and smart energy management solution from the Chinese company Galaxy Zhangtan iocharger. A security vulnerability exists in iocharger versions prior to 24120701, which stems from an unsatisfactory neutralization of a special element used in a command, whi...

PT-2024-36794 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.16 Description: An Improper URL Handling issue allows an attacker to access sensitive local files on the server by exploiting the file:/// protocol. This issue is triggered via the "real-browser" request typ...

PT-2024-39056 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions prior to 10.18.40.0 Description: Under specific circumstances, insecure permissions in Ivanti Workspace Control allow a local authenticated attacker to achieve local privilege escalation. Recommendations: For...