16951 matches found
CVE-2025-26580
Cross-Site Request Forgery CSRF vulnerability in Complete SEO Page/Post Specific Social Share Buttons pagepost-specific-social-share-buttons allows Stored XSS.This issue affects Page/Post Specific Social Share Buttons: from n/a through = 2.1...
CVE-2025-26551
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sureshdsk Bootstrap collapse bootstrap-collapse allows Stored XSS.This issue affects Bootstrap collapse: from n/a through = 1.0.4...
CVE-2025-26577
Cross-Site Request Forgery CSRF vulnerability in daxiawp DX-auto-publish dx-auto-publish allows Stored XSS.This issue affects DX-auto-publish: from n/a through = 1.2...
CVE-2025-0814
CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the network services running on the product when malicious IEC61850-MMS packets are sent to the device. The core functionality of the breaker remains intact during the attack...
BELL-CVE-2025-1094
Bulletin has no description...
CVE-2023-34400
Mercedes-Benz head-unit NTG6 contains functions to import or export profile settings over USB. In case of parsing file, service try to define header inside the file and convert it to null-terminated string. If character is missed, will return null pointer...
CVE-2024-53311
A Stack buffer overflow in the arguments parameter in Immunity Inc. Immunity Debugger v1.85 allows attackers to execute arbitrary code via a crafted input that exceeds the buffer size...
OSV-2025-124 Use-of-uninitialized-value in get_word
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=396172336 Crash type: Use-of-uninitialized-value Crash state: getword unpacksamples unpacksamplesworkerthread...
CVE-2024-32938
Uncontrolled search path for some IntelR MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2024-36280
Uncontrolled search path for some IntelR High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2024-36283
Uncontrolled search path for the IntelR Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2024-42405
Uncontrolled search path for some IntelR QuartusR Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable escalation of privilege via local access...
CVE-2025-25304 Vega allows Cross-site Scripting via the vlSelectionTuples function
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to version 5.26.0 of vega and 5.4.2 of vega-selections, the vlSelectionTuples function can be used to call JavaScript functions, leading to cross-site...
CVE-2025-25283
parse-duraton is software that allows users to convert a human readable duration to milliseconds. Versions prior to 2.1.3 are vulnerable to an event loop delay due to the CPU-bound operation of resolving the provided string, from a 0.5ms and up to 50ms per one operation, with a varying size from...
CVE-2024-11629
In Progress® Telerik® Document Processing Libraries, versions prior to 2025 Q1 2025.1.205, using .NET Standard 2.0, the contents of a file at an arbitrary path can be exported to RTF...
Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution
CWE-502 Deserialization of Untrusted Data at the eventmesh-meta-raft plugin module in Apache EventMesh master branch without release version on windows\linux\mac os e.g. platforms allows attackers to send controlled message and remote code execute via hessian deserialization rpc protocol. Users c...
CVE-2025-26350
A CWE-434 "Unrestricted Upload of File with Dangerous Type" in the template file uploads in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to upload malicious files via crafted HTTP requests...
CVE-2024-57603
An issue in MaysWind ezBookkeeping 0.7.0 allows a remote attacker to escalate privileges via the lack of rate limiting...
CVE-2024-13152
CVE-2024-13152 corresponds to an SQL Injection in BSS Software Mobuy Online Machinery Monitoring Panel, with root cause described as improper neutralization of special elements in SQL commands. Affected version: Mobuy Online Machinery Monitoring Panel before 2.0. Practical impact, as stated, incl...