WordPress File Manager, Code Editor, and Backup by Managefy plugin <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download vulnerability

Authenticated Admin+ Path Traversal to Arbitrary File Download vulnerability discovered by Đỗ Quang Huy in WordPress Plugin File Manager, Code Editor, and Backup by Managefy versions = 1.4.8...

SQL Injection

Overview nodebb is a package that utilizes web sockets for instant interactions and real-time notifications. Affected versions of this package are vulnerable to SQL Injection via the /api/v3/search/categories API endpoint when the search parameter is not properly sanitized. An attacker can execut...

Linux Distros Unpatched Vulnerability : CVE-2019-1010060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NASA CFITSIO prior to 3.43 is affected by: Buffer Overflow. The impact is: arbitrary code execution. The component is: over 40 source code files were changed. T...

Linux Distros Unpatched Vulnerability : CVE-2023-45807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the...

Linux Distros Unpatched Vulnerability : CVE-2021-32743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. In...

Linux Distros Unpatched Vulnerability : CVE-2022-32209

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerabili...

WordPress Lazy Load for Videos plugin <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability discovered by Webbernaut in WordPress Plugin Lazy Load for Videos versions = 2.18.7...

Arbitrary File Upload

Overview badaso/core is an API and platform builder Affected versions of this package are vulnerable to Arbitrary File Upload via the file-upload process. An attacker can execute arbitrary code on the server by uploading a file containing embedded PHP code, bypassing content-type validation, and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage or html methods. An attacker can cause excessive CPU utilization and application unresponsiveness by supplying malicious PNG image data or URLs. Details Denial of...

jsPDF Denial of Service (DoS)

Impact User control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG file that results in high CPU utilization and denial of...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.bowergithub.parallax:jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the addImage or html methods. An attacker can cause excessive CPU utilization and application...

CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG...

CVE-2025-57810 jsPDF Parsing of Corrupt PNGs Leads to Potential Denial of Service (DoS)

jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in CPU utilization and denial of service. If given the possibility to pass unsanitized image data or URLs to the addImage method, a user can provide a harmful PNG...

CVE-2025-8700 Privilege Escalation via get-task-allow entitlement in Invoice Ninja

Invoice Ninja's configuration on macOS, specifically the presence of entitlement "com.apple.security.get-task-allow", allows local attackers with unprivileged access e.g. via a malicious application to attach a debugger, read or modify the process memory, inject code in the application's context...

CVE-2025-8700

Invoice Ninja on macOS is affected by a local privilege-escalation issue due to the presence of the entitlement com.apple.security.get-task-allow. This allows unprivileged local attackers (e.g., via a malicious app) to attach a debugger, read/modify process memory, and inject code within the app’...

CVE-2025-9190

Cursor for macOS 15.4.1 is affected by a RunAsNode fuse misconfiguration that allows a local, unprivileged attacker to execute arbitrary code inheriting Cursor TCC permissions. Access to resources is limited to what the user previously granted; requesting other resources will prompt the user, pot...

CVE-2025-29901

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29901 File Station 5

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following version: File Station 5...

CVE-2025-29901

CVE-2025-29901 affects QNAP File Station 5. A NULL pointer dereference vulnerability could allow a remote attacker who has a user account to cause a denial-of-service on affected systems. The issue is rooted in File Station 5 (versions prior to 5.5.6.4933). A fixed release is available: File Stat...

WordPress WordPress Automatic plugin <= 3.118.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Automatic versions = 3.118.0...