Rocket.Chat <3.9.1 - Information Disclosure

Rocket.Chat through 3.9.1 is susceptible to information disclosure. An attacker can enumerate email addresses via the password reset function and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-28208 info: name: Rocket.Chat 3.9.1 -...

SureTriggers – All-in-One Automation Platform ≤ 1.0.78 - Authentication Bypass

The SureTriggers- All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due to a missing empty value check on the 'secretkey' value in the 'autheticateuser' function in all versions up to, and including, 1.0.78. Th...

Eyou E-Mail <3.6 - Remote Code Execution

Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php via the getloginipconfigfile function. id: CVE-2014-1203 info: name: Eyou E-Mail 3.6 - Remote Code Execution author: pikpik...

HyperComments <= 1.2.2 - Arbitrary Options Update

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

WordPress Burst Statistics 3.4.0-3.4.1.1 - Authentication Bypass

Burst Statistics – Privacy-Friendly WordPress Analytics plugin 3.4.0 to 3.4.1.1 contains an authentication bypass caused by incorrect return-value handling in ismainwpauthenticated function, letting unauthenticated attackers impersonate administrators, exploit requires knowledge of an administrat...

Bitrix24 <=20.0.0 - Cross-Site Scripting

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. id: CVE-2020-13483 info: name: Bitrix24 20.0.0 to mitigate this vulnerability. reference: -...

WordPress Personal Dictionary <1.3.4 - Blind SQL Injection

WordPress Personal Dictionary plugin before 1.3.4 contains a blind SQL injection vulnerability. The plugin fails to properly sanitize user-supplied POST data before being interpolated in an SQL statement and executed. An attacker can possibly obtain sensitive information, modify data, and/or...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

AppWeb - Authentication Bypass

The Embedthis HTTP library, and Appweb versions before 7.0.3, have a logic flaw related to the authCondition function in http/httpLib.c. With a forged HTTP request, it is possible to bypass authentication for the form and digest login types. id: CVE-2018-8715 info: name: AppWeb - Authentication...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests id: CVE-2025-44137 info: name: MapTiler Tileserver-php v2.0 -...

Casdoor - Authorization Bypass

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. id: CVE-2025-4210 info: name: Casdoor - Authorization Bypass author: theamanrawat severity:...

GHSA-XC2P-8GGW-6CR5 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, kapp-controller-fips, nodetaint-fips, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, mailpit, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...

GHSA-76P8-FHRM-VPC7 vulnerabilities

Vulnerabilities for packages: sonobuoy, crossplane-provider-aws-securityhub, hubble-fips, azurefile-csi, kapp-controller-fips, nodetaint-fips, rancher-system-agent, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, plutono, cluster-api,...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-securityhub, hubble-fips, azurefile-csi, kapp-controller-fips, rancher-system-agent, spire-controller-manager-fips, crossplane-provider-aws-cloudcontrol, kiali-fips, plutono, cluster-api, crossplane-provider-aws-mediastore,...

GHSA-7QCH-W8M5-G3H3 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-securityhub, azurefile-csi, crossplane-provider-aws-mediastore, flux-image-automation-controller-fips, crossplane-provider-aws-dataexchange, dockerize-fips, crossplane-function-patch-and-transform-fips, cert-manager-google-cas-issuer, go-sqlcm...

EUVD-2026-58810

Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC idtokens by exploiting the missing nonce claim validation in the getUserByOIDCToken function within FacebookProvider.php. Attackers who obtain a vali...

PT-2026-73045

The Link Library plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ll delete link fields function in all versions up to, and including, 7.9.4 This makes it possible for unauthenticated attackers to delete arbitrary files on the server,...

PT-2026-72826

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma copy user pgaddrs The irdma copy user pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or...