808 matches found
CVE-2025-49253
CVE-2025-49253 describes an Unauthenticated Local File Inclusion in the WordPress theme Lasa (thembay) versions
CVE-2025-49254 WordPress Nika theme <= 1.2.8 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Nika nika allows PHP Local File Inclusion.This issue affects Nika: from n/a through = 1.2.8...
CVE-2025-5982
An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditions users could bypass IP access restrictions and view sensitive information...
BIT-GITLAB-2024-9512 Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab
An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync...
CVE-2025-48918
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Simple Klaro allows Cross-Site Scripting XSS.This issue affects Simple Klaro: from 0.0.0 before 1.10.0...
CVE-2024-9512
An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may have been possible for private repository to be cloned in case of race condition when a secondary node is out of sync...
CVE-2025-1516
CVE-2025-1516 affects GitLab CE/EE and is caused by improper input validation in Tokens Names, which could trigger a denial of service. Affected versions are GitLab from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Multiple connected sources (Red Hat, Debian, Ubuntu, NVD, osv...
CVE-2025-47561
Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through 8.6.13...
CVE-2025-31022
Authentication Bypass Using an Alternate Path or Channel vulnerability in PayU India PayU India payu-india allows Authentication Abuse.This issue affects PayU India: from n/a through 3.8.8...
BIT-MARIADB-MIN-2021-2144
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Parser. Supported versions that are affected are 5.7.29 and prior and 8.0.19 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL...
CVE-2025-28986
Cross-Site Request Forgery CSRF vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through = 1.5...
CVE-2025-49237
Cross-Site Request Forgery CSRF vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through = 0.9.10...
CVE-2025-30632
CVE-2025-30632 describes a Cross-Site Request Forgery (CSRF) vulnerability in the pozzad Global Translator WordPress plugin. Affected software: Global Translator (versions up to 2.0.2). Root cause: CSRF vulnerability that could enable an attacker to induce authenticated users to perform unwanted ...
CVE-2025-49289 WordPress PDF for WPForms <= 5.5.0 - Broken Access Control Vulnerability
Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.5.0...
Grafana 10.4.x < 10.4.9 Multiple Vulnerabilities
According to its self-reported version, the Grafana install hosted on the remote host is 10.3.x earlier than 10.3.10, or 10.4.x earlier than 10.4.9, or 11.0.x earlier than 11.0.5, or 11.1.x earlier than 11.1.6, or 11.2.x earlier than 11.2.1. It is, therefore, affected by multiple vulnerabilities:...
BIT-DRUPAL-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...
Microsoft Raw Image Extension Multiple Vulnerabilities (May 2025) - Windows
Microsoft Raw Image Extension is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2025-27522
Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a secondary mining bypass for CVE-2024-26579. Users are advised to upgrade to Apache InLong's 2.2.0 or cherry-pick 1 to solve it. 1...
CVE-2025-5262
A double-free could have occurred in vpxcodecencinitmulti after a failed allocation when initializing the encoder for WebRTC. This could have caused memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 139 and Thunderbird 128.11...