CVE-2024-23832

Mastodon is a free, open-source social network server based on ActivityPub Mastodon allows configuration of LDAP for authentication. Due to insufficient origin validation in all Mastodon, attackers can impersonate and take over any remote account. Every Mastodon version prior to 3.5.17 is...

CVE-2024-5526

Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...

CVE-2024-27922

TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may var...

CVE-2024-6974

Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34...

CVE-2024-2796

A server-side request forgery SSRF was discovered in the Akana API Platform in versions prior to and including 2022.1.3. Reported by Jakob Antonsson...

NDD Print 安全漏洞

NDD Print is an international solution from NDD focused on the printing business. A security vulnerability exists in NDD Print versions prior to 5.24.3. An attacker exploiting this vulnerability could gain SYSTEM-level access on the device...

PT-2025-5725 · Kemp · Loadmaster +1

Name of the Vulnerable Software and Affected Versions: LoadMaster versions 7.2.55.0 through 7.2.60.1 LoadMaster versions 7.2.49.0 through 7.2.54.12 LoadMaster version 7.2.48.12 and all prior versions Multi-Tenant Hypervisor version 7.1.35.12 and all prior versions ECS versions prior to 7.2.60.1...

CVE-2024-8014

In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924, a code execution attack is possible through object injection via an insecure type resolution vulnerability...

UBUNTU-CVE-2025-1018

The fullscreen notification is prematurely hidden when fullscreen is re-requested quickly by the user. This could have been leveraged to perform a potential spoofing attack. This vulnerability was fixed in Firefox 135 and Thunderbird 135...

WordPress plugin WP Dream Carousel 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Ashlar-Vellum Cobalt 安全漏洞

Ashlar-Vellum Cobalt is a parametric-based computer-aided design and 3D modeling program from Ashlar-Vellum. A security vulnerability exists in versions prior to Ashlar-Vellum Cobalt v12 SP2 Build 1204.200 that stems from a lack of proper validation of user-supplied data when parsing CO files. An...

PT-2025-5613 · Unknown · Activity Log Winterlock

Name of the Vulnerable Software and Affected Versions: Activity Log WinterLock versions prior to 1.2.5 Description: A cross-site request forgery issue exists. If a user views a malicious page while logged in, the log data may be deleted. Recommendations: For versions prior to 1.2.5, update to...

PT-2025-4627 · WordPress · Wp Travel

Name of the Vulnerable Software and Affected Versions: WP Travel versions prior to 10.1.0 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This means that an attacker could potentially inject malicious SQL code to...

WordPress plugin WP BASE Booking 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-5394 · Unknown · Alexandros Georgiou Bitcoin/Altcoin Wallets

Name of the Vulnerable Software and Affected Versions: Alexandros Georgiou Bitcoin and Altcoin Wallets versions prior to 6.3.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS attacks, specifically Reflecte...

PT-2025-4955 · Unknown · Wow Best Css Compiler

Name of the Vulnerable Software and Affected Versions: WOW Best CSS Compiler versions prior to 2.0.3 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious script...

PT-2025-4622 · Hakan Ozevin · Wp Base Booking

Name of the Vulnerable Software and Affected Versions: Hakan Ozevin WP BASE Booking versions prior to 5.0.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject...

PT-2025-4117 · Zenvia · Zenvia Movidesk

Name of the Vulnerable Software and Affected Versions: Zenvia Movidesk versions prior to 25.01.22.245a473c54 Description: A problematic issue was found in Zenvia Movidesk, affecting some unknown functionality of the file /Account/EditProfile of the component Profile Editing. The manipulation of t...

CVE-2024-53295

Dell PowerProtect DD (Dell’s data protection solution) is affected by an improper access control vulnerability (CVE-2024-53295) that could allow a local, low-privilege attacker to escalate privileges. Affected versions are prior to 8.3.0.0, 7.10.1.50, and 7.13.1.20. The NVD entry documents a LOCA...

CVE-2025-21107

Dell NetWorker, versions prior to 19.11.0.3, all versions of 19.10 & prior versions contains an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution...