Archive
6 August 2025
Vulnerabilities first published on this day (UTC), newest first.
217 results · Feed
-
Medium 4.4
Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Succ…
-
Medium 4.4
Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successf…
-
Medium 5.9
Vulnerability of returning released pointers in the distributed notification service. Impact: Successful exploitation o…
-
High 8.1
Multiple Plugins by emarket-design <= Multiple Versions - Unauthenticated Limited Remote Code Execution
Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the emd_form_builder_lite_pagenum function. This is due to the plugin not properly validating user input …
-
Medium 4.3
Zakra <= 4.1.5 - Missing Authorization to Subscriber+ Demo Import
The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.1.5. This makes it possible for authenticated attackers, wi…
-
High 8.0
Vulnerability of improper processing of abnormal conditions in huge page separation. Impact: Successful exploitation of…
-
Medium 6.7
Out-of-bounds read vulnerability in the register configuration of the DMA module. Impact: Successful exploitation of th…
-
Medium 6.8
Vulnerability of insufficient data length verification in the HVB module. Impact: Successful exploitation of this vulne…
-
Medium 6.7
Vulnerability of insufficient data length verification in the partition module. Impact: Successful exploitation of this…
-
Medium 6.8
:Vulnerability of insufficient data length verification in the DFA module. Impact: Successful exploitation of this vuln…
-
Medium 6.7
Race condition issue occurring in the physical page import process of the memory management module. Impact: Successful …
-
Medium 5.3
Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of th…
-
High 8.8
Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 6.7
Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of this vulnerability ma…
-
Medium 4.4
Pointer dangling vulnerability in the cjwindow module. Impact: Successful exploitation of this vulnerability may affect…
-
Medium 5.7
Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnera…
-
Medium 6.4
WPBakery Page Builder for WordPress <= 8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and including, 8.5 due to insufficient input sanitization and output escaping on user supplied attributes. …
-
Medium 6.5
FileBird – WordPress Media Library Folders & File Manager <= 6.4.8 - Authenticated (Author+) SQL Injection
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 6.4.8 due to insufficient escaping on the user supplied parameter and lack of su…
-
Medium 6.4
Flex Guten <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via thumbnailHoverEffect Parameter
The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including, 1.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authen…
-
Medium 6.4
WP Tournament Registration <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via field Parameter
The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authe…
-
High 7.5
CleverReach WP <= 1.5.20 - Unauthenticated SQL Injection via title Parameter
The CleverReach® WP plugin for WordPress is vulnerable to time-based SQL Injection via the ‘title’ parameter in all versions up to, and including, 1.5.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi…
-
Medium 6.4
esri-map-view <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via esri-map-view Shortcode
The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping on user supplied attributes. Th…
-
Medium 6.3
Out-of-bounds read vulnerability in the devicemanager module. Impact: Successful exploitation of this vulnerability may…
-
High 8.3
Binding authentication bypass vulnerability in the devicemanager module. Impact: Successful exploitation of this vulner…
-
Medium 5.3
Iterator failure issue in the WantAgent module. Impact: Successful exploitation of this vulnerability may cause memory …
-
Medium 5.5
Deserialization vulnerability of untrusted data in the ability module. Impact: Successful exploitation of this vulnerab…
-
Medium 5.3
Iterator failure issue in the multi-mode input module. Impact: Successful exploitation of this vulnerability may cause …
-
Medium 5.7
Permission control vulnerability in the distributed clipboard module. Impact: Successful exploitation of this vulnerabi…
-
Medium 6.8
Stack-based buffer overflow vulnerability in the dms_fwk module. Impact: Successful exploitation of this vulnerability …
-
Medium 4.0
Out-of-bounds array access vulnerability in the ArkUI framework. Impact: Successful exploitation of this vulnerability …
-
Medium 6.2
Vulnerability of insufficient information protection in the media library module. Impact: Successful exploitation of th…
-
Medium 6.2
Input verification vulnerability in the home screen module. Impact: Successful exploitation of this vulnerability may a…
-
Medium 5.9
Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may…
-
Medium 5.9
Iterator failure vulnerability in the card management module. Impact: Successful exploitation of this vulnerability may…
-
Medium 6.8
Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability
Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this …
-
Medium 6.8
Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability
Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to expl…
-
High 8.8
Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability
Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploi…
-
High 8.8
Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability
Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR. Authentication is not required to ex…
-
Medium 6.8
Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability
Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exp…
-
Medium 6.8
Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability
Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exp…