Archive
2 October 2025
Vulnerabilities first published on this day (UTC), newest first.
120 results · Feed
-
High 7.4
Privilege Escalation via WebSocket Connection Hijacking in LXD Operations API
Privilege Escalation in operations API in Canonical LXD <6.5 on multiple platforms allows attacker with read permissions to hijack terminal or console sessions and execute arbitrary commands via WebSocket connection hijacking format
-
Medium 5.1
Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device informat…
-
High 7.1
Arbitrary File Read via Template Injection in Snapshot Patterns
Template Injection in instance snapshot creation component in Canonical LXD (>= 4.0) allows an attacker with instance configuration permissions to read arbitrary files on the host system via specially crafted snapshot pattern templates using the Pongo2 templa…
-
High 7.5
CSRF Vulnerability When Using Client Certificate Authentication with the LXD-UI
Cross-Site Request Forgery (CSRF) in LXD-UI in Canonical LXD versions >= 5.0 on Linux allows an attacker to create and start container instances without user consent via crafted HTML form submissions exploiting client certificate authentication.
-
Critical 9.8
Ajax WooSearch <= 1.0.0 - Unauthenticated SQL Injection
The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection
-
High 8.6
CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection
The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
-
High 7.8
KV STUDIO versions 12.23 and prior contain a buffer underflow vulnerability. If the product uses a specially crafted fi…
-
High 7.8
VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file,…
-
High 7.8
VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted …
-
High 7.8
VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a speci…
-
High 7.8
KV Studio versions 12.23 and prior contain a stack-based buffer overflow vulnerability. If the product uses a specially…
-
High 7.8
KV STUDIO and VT5-WX15/WX12 contain a stack-based buffer overflow vulnerability. If the product uses a specially crafte…
-
High 8.8
Remote Code Execution in MarkAny SafePC Enterprise
An attacker can obtain server information using Path Traversal vulnerability to conduct SQL Injection, which possibly exploits Unrestricted Upload of File with Dangerous Type vulnerability in MarkAny SafePC Enterprise on Windows, Linux.This issue affects Safe…
-
High 8.8
Remote Code Execution in GTONE ChangeFlow
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type vulnerability in GTONE ChangeFlow allows Path Traversal, Accessing Functionality Not Properly Constrained by ACLs.This issue affect…
-
Medium 6.5
File Download in GTONE ChangeFlow
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Download of Code Without Integrity Check vulnerability in GTONE ChangeFlow allows Path Traversal.This issue affects ChangeFlow: All versions to v9.0.1.1.
-
High 7.5
TP-Link AX1800 WiFi 6 Router (Archer AX21) devices allow unauthenticated attackers (on the LAN) to execute arbitrary co…
-
High 7.5
The Flock Safety Peripheral com.flocksafety.android.peripheral application 7.38.3 for Android (installed on Falcon and …
-
High 7.5
Flock Safety Falcon and Sparrow License Plate Readers OPM1.171019.026 ship with development Wi-Fi credentials (test_flc…
-
Critical 9.8
The Flock Safety DetectionProcessing com.flocksafety.android.objects application 6.35.33 for Android (installed on Falc…
-
Critical 9.8
The Flock Safety Android Collins application (aka com.flocksafety.android.collins) 6.35.31 for Android lacks authentica…
-
Medium 6.2
The Flock Safety Pisco com.flocksafety.android.pisco application 6.21.11 for Android (installed on Falcon and Sparrow L…
-
High 7.2
SSH Tectia Server before 6.6.6 sometimes allows attackers to read and alter a user's session traffic.
-
Medium 6.1
SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name f…
-
Medium 6.5
PHPGurukul Online Shopping Portal Project v2.1 is vulnerable to SQL Injection in /shopping/login.php via the fullname p…
-
High 7.5
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanSpeed parameter in the fromAdvSetMacMtuWa…
-
High 7.5
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the wanMTU parameter in the fromAdvSetMacMtuWan …
-
Medium 5.3
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the cloneType parameter in the fromAdvSetMacMtuW…
-
High 7.5
Tenda AC18 V15.03.05.19 was discovered to contain a stack overflow via the mac parameter in the fromAdvSetMacMtuWan fun…
-
Medium 5.4
PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability …
-
Medium 5.1
FrostWire 6.14.0-build-326 for macOS contains permissive entitlements (allow-dyld-environment-variables, disable-librar…
-
Medium 6.5
VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp.
-
High 7.1
The Matrix specification before 1.16 (i.e., with a room version before 12) lacks create event uniqueness.
-
Medium 6.5
YOSHOP 2.0 suffers from an unauthenticated SQL injection in the goodsIds parameter of the /api/goods/listByIds endpoint…
-
Medium 6.5CVE-2025-56381 Public exploit
ERPNEXT v15.67.0 was discovered to contain multiple SQL injection vulnerabilities in the /api/method/frappe.desk.report…
-
Medium 6.1
htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The…
-
Medium 6.5CVE-2025-56380 Public exploit
Frappe Framework v15.72.4 was discovered to contain a SQL injection vulnerability via the fieldname parameter in the fr…
-
High 7.5
YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Commen…
-
Medium 5.4CVE-2025-56379 Public exploit
A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to exec…
-
Medium 6.5CVE-2025-56019 Public exploit
An insecure permission vulnerability exists in the Agasta Easytouch+ version 9.3.97 The device allows unauthorized mobi…
-
High 7.1
The Matrix specification before 1.16 (i.e., with a room version before 12 and State Resolution before 2.1) has deficien…