Archive
6 January 2026
Vulnerabilities first published on this day (UTC), newest first.
102 results · Clear filters · Feed
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
-
Medium 5.5
Information Exposure in Computer Vision
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
-
Medium 6.7
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while handling sensor utility operations.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while accessing a synchronization object during concurrent operations.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while performing sensor register read operations.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Camera Driver
Memory corruption while parsing clock configuration data for a specific hardware type.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Camera Driver
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while handling buffer mapping operations in the cryptographic driver.
-
Medium 6.7
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while processing a config call from userspace.
-
Medium 6.1
Buffer Over-read in Video
Information disclosure while processing a firmware event.
-
Medium 5.5
Buffer Over-read in Video
Transient DOS while parsing video packets received from the video firmware.
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Windows (Nios II Command Shell modules) allows Search Order Hijacking.This issue affects Quartus Prime Sta…
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Explore for Predictable Temporary File Names.This issue affects Quartus Prime Standard: from 23.1 …
-
Medium 6.7
Quartus® Prime Standard and Quartus® Prime Lite Security Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Standard: from 23.1 through 24.1; …
-
Medium 6.7
Quartus Prime Pro Edition Advisory
Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows : Use of Predictable File Names.This issue affects Quartus Prime Pro: from 24.1 through 25.1.1.
-
Medium 6.7
Quartus Prime Pro Edition Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 17.0 through 25.1.1.
-
Medium 5.3
WordPress Plant - Gardening & Houseplants WordPress Theme <= 1.0.0 - Sensitive Data Exposure Vulnerability
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Retrieve Embedded Sensitive Data.This issue affects Plant - Gardening & Houseplants WordPress Theme: f…
-
Medium 6.7
Quartus Prime Pro Edition Installer Advisory
Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quartus Prime Pro: from 24.1 through 24.3.1.
-
Medium 5.5
iccDEV ToneMap Writer has NULL Pointer Member Call
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. Versions prior to 2.3.1.2 have a NULL pointer member call vulnerability. This vulnera…
-
Medium 4.3
On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o
On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption of d…
-
Medium 6.1
iccDEV has unicode buffer overflow in CIccTagTextDescription
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV libr…
-
Medium 6.1
iccDEV has heap buffer overflow in CIccTagLut16::Validate()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV libr…
-
Medium 6.3
TOTOLINK WA300 cstecgi.cgi sub_401510 command injection
A security vulnerability has been detected in TOTOLINK WA300 5.2cu.7112_B20190227. This vulnerability affects the function sub_401510 of the file cstecgi.cgi. The manipulation of the argument UPLOAD_FILENAME leads to command injection. The attack may be initi…
-
Medium 6.1
iccDEV has heap buffer overflow in CIccTagLut8::Validate()
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium (ICC) color management profiles. A vulnerability present in versions prior to 2.3.1.2 affects users of the iccDEV libr…
-
Medium 5.1
Client SCP Request Triggers Buffer Overread by 1 Byte
A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted SCP path input containing '/./' sequences, resulting in a heap over read by 1 byte.
-
Medium 6.5
WordPress AdsPlace'r – Ad Manager, Inserter, AdSense Ads plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPShop.Ru AdsPlace'r – Ad Manager, Inserter, AdSense Ads allows DOM-Based XSS.This issue affects AdsPlace'r – Ad Manager, Inserter, AdSense Ads: from …
-
Medium 4.3
WordPress Post Expirator plugin <= 4.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Expirator: from n/a through <= 4.9.3.
-
Medium 6.5
WordPress Responsive Addons for Elementor plugin <= 2.0.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Addons for Elementor: from n/a through <= …
-
Medium 5.9
WordPress UiChemy plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue affects UiChemy: from n/a through <= 4.4.2.
-
Medium 5.3
WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
-
Medium 4.3
WordPress Better Business Reviews plugin <= 0.1.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in BBR Plugins Better Business Reviews better-business-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Business Reviews: from n/a through <= 0.1.1.
-
Medium 5.3
WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through <= 1.1.12.
-
Medium 6.5
WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements allows DOM-Based XSS.This issue affects TheGem Theme Elements (for WPBakery): from n/a throu…
-
Medium 4.3
WordPress Tickera plugin <= 3.5.6.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.4.
-
Medium 6.5
WordPress TheGem Theme Elements (for Elementor) plugin <= 5.11.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-elements-elementor allows Stored XSS.This issue affects TheGem Theme Elements (for Elementor): from …
-
Medium 5.9
WordPress Accordion plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion accordions-wp allows Stored XSS.This issue affects Accordion: from n/a through <= 3.0.3.
-
Medium 4.3
WordPress Proxy & VPN Blocker plugin <= 3.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Proxy & VPN Blocker Proxy & VPN Blocker proxy-vpn-blocker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Proxy & VPN Blocker: from n/a through <= 3.5.3.
-
Medium 5.4
WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through <= 6.15.12.2.
-
Medium 4.3
WordPress AffiliateX plugin <= 1.3.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPCenter AffiliateX affiliatex allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AffiliateX: from n/a through <= 1.3.9.3.
-
Medium 4.3
WordPress Post and Page Builder by BoldGrid plugin <= 1.27.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.