35,507 results · Clear filters · Feed
-
High 7.5
WordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Retrieve Embedded Sensitive Data.This issue affects Atarim: from n/a through <= 4.2.1.
-
High 8.1CVE-2025-63307 Public exploit
alexusmai laravel-file-manager 3.3.1 is vulnerable to Cross Site Scripting (XSS). The application permits user-controll…
-
High 7.1CVE-2025-63588 Public exploit
An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attac…
-
High 7.1CVE-2025-63589 Public exploit
A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are n…
-
High 7.3CVE-2025-43990 Public exploit
Dell Command Monitor (DCM), versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerabili…
-
High 8.6CVE-2025-20343 Public exploit
Cisco Identity Services Engine Radius Suppression Denial of Service Vulnerability
A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to cause Cisco ISE to restart unexpectedly. This vulnerability is due to a…
-
Critical 9.1
Potential SQL injection via _connector keyword argument in QuerySet and Q objects
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, wit…
-
High 7.5CVE-2025-64458 Public exploit
Potential denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
An issue was discovered in 5.1 before 5.1.14, 4.2 before 4.2.26, and 5.2 before 5.2.8. NFKC normalization in Python is slow on Windows. As a consequence, `django.http.HttpResponseRedirect`, `django.http.HttpResponsePermanentRedirect`, and the shortcut `django…
-
Critical 9.8CVE-2025-12674 Public exploit
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbit…
-
High 7.5
File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure
The File Manager for Google Drive – Integrate Google Drive with WordPress plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.5.3 via the "get_localize_data" function. This makes it possible for unauthe…
-
Critical 9.8
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for u…
-
Critical 9.8CVE-2025-12735 Public exploit
CVE-2025-12735
The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables. However, due to insufficient input validation, an attacker can pass a crafted context object or use MEMBER …
-
Medium 6.5CVE-2025-63585 Public exploit
OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp par…
-
Critical 9.8CVE-2025-61304 Public exploit
OS command injection vulnerability in Dynatrace ActiveGate ping extension up to 1.016 via crafted ip address.
-
High 7.7CVE-2025-62507 Public exploit
Redis: Bug in XACKDEL may lead to stack overflow and potential RCE
Redis is an open source, in-memory database that persists on disk. In versions 8.2.0 and above, a user can run the XACKDEL command with multiple ID's and trigger a stack buffer overflow, which may potentially lead to remote code execution. This issue is fixed…
-
High 7.2CVE-2025-62369 Public exploit
Xibo CMS: Remote Code Execution through module templates
Xibo is an open source digital signage platform with a web content management system (CMS). Versions 4.3.0 and below contain a Remote Code Execution vulnerability in the CMS Developer menu's Module Templating functionality, allowing authenticated users with "…
-
Medium 6.7CVE-2025-20730 Public exploit
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local es…
-
Medium 5.5CVE-2025-43426 Public exploit
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Taho…
-
High 7.8CVE-2025-43407 Public exploit
This issue was addressed with improved entitlements. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and …
-
Medium 4.9CVE-2025-43504 Public exploit
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privilege…
-
High 7.5CVE-2024-56426 Public exploit
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 990, 850, 1080, 2100, 1280, 2200…
-
Critical 9.8
Command injection in React Native Community CLI allows remote attackers to perform remote code execution by sending HTTP requests
The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoint that is vulnerable to OS command injection. This allows unauthenticated network attackers to send a POST r…
KEV Feb 5, 2026 -
Medium 5.4CVE-2025-50363 Public exploit
Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php va the nam…
-
High 7.3CVE-2025-63441 Public exploit
Open Source Social Network (OSSN) 8.6 is vulnerable to Cross Site Scripting (XSS) via the parameter param` at endpoint …
-
High 8.7CVE-2025-60503 Public exploit
A cross-site scripting (XSS) vulnerability exists in the administrative interface of ultimatefosters UltimatePOS 4.8 wh…
-
Medium 4.9CVE-2025-12137 Public exploit
Import WP – Export and Import CSV and XML files to WordPress <= 2.14.16 - Authenticated (Admin+) Arbitrary File Read
The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. This is due to the plugin's REST API endpoint accepting arbitrary absolute file paths wit…
-
Medium 6.5CVE-2025-11740 Public exploit
wpForo Forum <= 2.4.9 - Authenticated (Susbscriber+) SQL Injection
The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the Subscriptions Manager in all versions up to, and including, 2.4.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL q…
-
Critical 9.8
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. Thi…
-
Medium 5.3CVE-2025-11174 Public exploit
Document Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure
The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6. This is due to the plugin exposing an unauthenticated AJAX action dll_load_posts which returns a JSON table of document data wi…
-
Medium 4.8CVE-2025-59501 Public exploit
Microsoft Configuration Manager Spoofing Vulnerability
Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.
-
High 8.6
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
The WooCommerce Designer Pro theme for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.9.28. This makes it possible for unauthenticated attackers to read arbitrary files on the server, which can expose DB credentials whe…
-
Critical 9.8CVE-2025-8489 Public exploit
King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users …
-
High 7.8CVE-2025-60749 Public exploit
DLL Hijacking vulnerability in Trimble SketchUp desktop 2025 via crafted libcef.dll used by sketchup_webhelper.exe.
-
High 8.8CVE-2025-62726 Public exploit
n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
n8n is an open source workflow automation platform. Prior to 1.113.0, a remote code execution vulnerability exists in the Git Node component available in both Cloud and Self-Hosted versions of n8n. When a malicious actor clones a remote repository containing …
-
Medium 6.5CVE-2025-11627 Public exploit
Site Checkup AI Troubleshooting with Wizard and Tips for Each Issue <= 1.47 - Unauthenticated Log File Poisoning
The Site Checkup Debug AI Troubleshooting with Wizard and Tips for Each Issue plugin for WordPress is vulnerable to log file poisoning in all versions up to, and including, 1.47. This makes it possible for unauthenticated attackers to insert arbitrary content…
-
High 8.2CVE-2025-63298 Public exploit
A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin…
-
High 8.1
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit …
-
Low 3.5CVE-2025-11203 Public exploit
LiteLLM Information health API_KEY Information Disclosure Vulnerability
LiteLLM Information health API_KEY Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of LiteLLM. Authentication is required to exploit this vulnerability. The specific …
-
High 7.8CVE-2025-61156 Public exploit
Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privi…
-
High 8.2CVE-2025-60595 Public exploit
SPH Engineering UgCS 5.13.0 is vulnerable to Arbitary code execution.