25,538 results · Clear filters · Feed
-
Critical 9.1
Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.
When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates. This c…
-
Critical 9.3
SQL Injection Vulnerability in Radius Xenia M2M Platform
This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by sup…
-
Critical 9.8
Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload
The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a spoofable client-supplied content type, allowing unauthenticated attackers to upload arbitrary files, including PHP, which can lead to remote …
-
Critical 9.9
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal
The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with minimal permissions, such as subscribers, to read arbitrary files (including ones con…
-
Critical 9.8
LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset
The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved account's own email address, mailing it to the address supplied in the request instead, allowing unauthenticated attackers to reset any user's p…
-
Critical 9.0
Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection
The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP o…
-
Critical 9.8
Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Token
The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.3.0. The `/wp-json/woo-telegram/v1/main/` REST endpoint is registered with `permission_callback…
-
Critical 9.8
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially…
-
Critical 9.4
Unrestricted Command Execution via system.execute
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arb…
-
Critical 9.8
The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacke…
-
Critical 9.8
An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.
-
Critical 9.1
Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exporte…
-
Critical 9.1
Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to anot…
-
Critical 9.1
Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an expor…
-
Critical 9.8
An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in th…
-
Critical 9.1
Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows …
-
Critical 9.1
Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's S…
-
Critical 9.1
Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized att…
-
Critical 9.1
Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in ano…
-
Critical 9.1
Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an …
-
Critical 9.1
Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported componen…
-
Critical 9.1
Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an export…
-
Critical 9.8
An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another u…
-
Critical 9.1
Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read n…
-
Critical 9.1
Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers …
-
Critical 9.1
Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorize…
-
Critical 9.1
Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read an…
-
Critical 9.1
Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading t…
-
Critical 9.8
An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execut…
-
Critical 9.1
Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write …
-
Critical 9.8
OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-wit…
-
Critical 9.1
DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_…
-
Critical 9.8
D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor
A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is pos…
-
Critical 10.0
AVideo-Encoder: unauthenticated command execution through streamer login trust
AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session state. An un…
-
Critical 10.0
AVideo-Encoder: unauthenticated installer PHP code injection
AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP string lit…
-
Critical 9.8
Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs
Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forg…
-
Critical 9.1
Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authoriz…
-
Critical 9.4
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privileged operations without `isLoggedIn()` authentication checks, CSRF protection or ad…
-
Critical 9.1
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an…
-
Critical 9.1
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk
HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chu…