Archive
6 January 2026
Vulnerabilities first published on this day (UTC), newest first.
185 results · Feed
-
High 8.8
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinc…
-
High 7.3
projectworlds House Rental and Property Listing Signup register.php unrestricted upload
A flaw has been found in projectworlds House Rental and Property Listing 1.0. Impacted is an unknown function of the file /app/register.php?action=reg of the component Signup. This manipulation of the argument image causes unrestricted upload. Remote exploita…
-
High 7.8
Double Free in Graphics
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
-
High 7.8
Buffer Copy Without Checking Size of Input in DSP Service
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
-
High 7.8
Improper Validation of Array Index in Automotive Linux OS
Memory corruption when accessing resources in kernel driver.
-
High 7.8
Buffer Copy without Checking Size of Input in DSP Service
Memory corruption while passing pages to DSP with an unaligned starting address.
-
High 7.8
Untrusted Pointer Dereference in Camera
Memory corruption while preprocessing IOCTLs in sensors.
-
Medium 5.5
Information Exposure in Computer Vision
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
-
High 7.8
Double Free in Video
Memory Corruption when multiple threads concurrently access and modify shared resources.
-
High 7.8
Use of Uninitialized Variable in HLOS
Memory corruption while processing identity credential operations in the trusted application.
-
High 7.8
Out-of-bounds Write in HLOS
Memory corruption while processing a secure logging command in the trusted application.
-
High 8.4
Reusing a Nonce, Key Pair in Encryption in Automotive Platform
Cryptographic issue may occur while encrypting license data.
-
Medium 6.7
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while handling sensor utility operations.
-
High 7.8
Untrusted Pointer Dereference in Video
Memory corruption while processing a video session to set video parameters.
-
High 7.8
Use After Free in HLOS
Memory corruption while deinitializing a HDCP session.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while accessing a synchronization object during concurrent operations.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while performing sensor register read operations.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Camera Driver
Memory corruption while parsing clock configuration data for a specific hardware type.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Camera Driver
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while handling buffer mapping operations in the cryptographic driver.
-
Medium 6.7
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while processing a config call from userspace.
-
Medium 6.1
Buffer Over-read in Video
Information disclosure while processing a firmware event.
-
Medium 5.5
Buffer Over-read in Video
Transient DOS while parsing video packets received from the video firmware.
-
Low 2.4
projectworlds House Rental and Property Listing complaint.php cross site scripting
A vulnerability was detected in projectworlds House Rental and Property Listing 1.0. This issue affects some unknown processing of the file /app/complaint.php. The manipulation of the argument Name results in cross site scripting. The attack may be launched r…
-
Low 3.7
MOVEit Transfer REST API does not require current password in order to initiate the password change process
Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 2023.1.3, from 2023.0.0 before 2023.0.8, from 2022.1.0 before 2022.1.11, from 2022.0.0 before 2022.0.10.
-
High 7.2CVE-2025-15472 EPSS 22%
TRENDnet TEW-811DRU httpd uapply.cgi setDeviceURL os command injection
A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation of the argument DeviceURL causes os command injection. The attack can be initiated remotely. The ex…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Sta…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 …
-
Critical 9.8CVE-2025-15471 EPSS 14%
TRENDnet TEW-713RE formFSrvX os command injection
A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the argument SZCMD results in os command injection. It is possible to launch the attack remotely. The expl…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; …
-
Medium 6.7
Quartus Prime Pro Edition Advisory
Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 24.1 through 25.1.1.
-
Medium 6.7
Quartus Prime Pro Edition Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1.
-
High 7.1
WordPress WPCHURCH plugin <= 2.7.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue affects WPCHURCH: from n/a through 2.7.0.
-
Medium 5.3
WordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure Vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensitive Data.This issue affects Plant - Gardening & Houseplants WordPress Theme: f…
-
Medium 6.7
Quartus Prime Pro Edition Installer Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1.
-
Critical 9.9
Arbitrary File Upload Vulnerability in WordPress themes by Themify
Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify Themify Edmin, Themify Bloggie, Themify Photobox, Themify Wigi, Themify Rezo, Themify Slide allows …
-
High 8.4
Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed rendering of malicious HTML
An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML to be rendered by the Filter component (search) across GitHub that could be used to exfiltrate sensit…
-
High 7.1
Reflected Cross Site Scripting (XSS) vulnerability in AA-Team WordPress plugins
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) allows Reflected XSS.This issu…
-
High 8.8
Privilege Escalation Vulnerability in AA-Team WordPress plugins
Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Holding Page for WordPress allows Privilege Escalation.This issue affects Premium Age Verification / Re…