CVE-2025-14167

The Remove Post Type Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to incorrect nonce validation logic that uses OR || instead of AND &&, causing the validation to fail when the nonce field is not empty OR when...

CVE-2026-0561

The Shield Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 21.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...

CVE-2026-26975

Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers to execute arbitrary code on affected installations. The music/playlists/update API allows users to bypass...

PT-2026-21284

Fiverr Clone Script 1.2.2 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the keyword parameter. Attackers can craft URLs with script tags in the keyword parameter of search-results.php to execute arbitrary JavaScript...

The vulnerability in the debugging interface of AMD’s microprogramming graphics processor allows a perpetrator to compromise the confidentiality and integrity of the protected information.

The vulnerability of the debugging interface for AMD graphics processor microprogramming software is related to access control deficiencies. Exploiting this vulnerability can allow a remote attacker to compromise the confidentiality and integrity of the protected information...

The vulnerability of the software platform based on Git for collaborative code development in GitLab Enterprise Edition (EE) stems from the lack of authentication procedures, which allow unauthorized users to gain unauthorized access to the AI model settings.

The vulnerability of the Git-based software platform for collaborative code development in GitLab Enterprise Edition is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the AI model...

The vulnerability of the enter_rtas() function in the arch/powerpc/kernel/rtas_entry.S module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the enterrtas function in the arch/powerpc/kernel/rtasentry.S module of the Linux operating system’s kernel is related to the improper disabling or release of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-21002

This vulnerability allows authenticated attackers to read an arbitrary file by changing a filepath parameter into an internal system path...

PT-2026-21283

Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can supply malicious SQL syntax in the page parameter to extract sensitive database information or...

RustDesk 后置链接漏洞

RustDesk is a remote access and control software developed by RustDesk personal developers. It is primarily written in Rust and can be used to maintain computers and other devices remotely. The RustDesk Client for Windows has a post-release link vulnerability, which stems from a symbolic link iss...

Foscam Video Management System 安全漏洞

The Foscam Video Management System is a monitoring video management system developed by the American company Foscam. Version 1.1.6.6 of the Foscam Video Management System contains a security vulnerability. This vulnerability stems from a buffer overflow in the UID field, which could allow local...

PT-2026-21318

OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to...

Sricam DeviceViewer 安全漏洞

Sricam DeviceViewer is a monitoring video management software developed by Sricam Corporation. Version 3.12.0.1 of Sricam DeviceViewer contains a security vulnerability. This vulnerability stems from a stack buffer overflow issue in the user management feature, which may allow authenticated...

CVE-2026-26721

An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter...

Key Systems Global Facilities Management Software 安全漏洞

Key Systems Global Facilities Management Software is a facilities management system developed by the American company Key Systems. Version 20230721a of Key Systems Global Facilities Management Software contains a security vulnerability. This vulnerability stems from issues with the sid query...

CVE-2025-69725

An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain...

CVE-2026-26338 Hyland Alfresco Transformation Service SSRF

Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve server-side request forgery SSRF through the document processing functionality...

CVE-2026-2274 Arbitrary File Read and SSRF in Google AppSheet

A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authenticated remote attacker to read sensitive local files and access internal network resources via crafted requests to the production cluster. This vulnerability was patched and no...

CVE-2019-25414

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the ID parameter. Attackers can craft requests to the /manage/ips/appid/ endpoint with script payloads in the ID parameter to execut...

CVE-2019-25404

Comodo Dome Firewall 2.7.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input through admin management parameters. Attackers can inject script payloads in the adminname, name, and surname parameters via...