CVE Brief Security Intelligence

Jenkins Azure CLI Plugin 0

LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite)

Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to blind SQL Injection via the `phrase` parameter in all versions up to, and including, 1

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Majestic Support Majestic Support majestic-support allows PHP Local File Inclusion

The installer of WTW EAGLE (for Windows) 3

The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4

Bitcoin Core through 29

Bitcoin Core through 29

Jenkins SAML Plugin 4

Jenkins JDepend Plugin 1

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

GIMP ICNS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

GIMP HDR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP DCM File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

GIMP WBMP File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP FF File Parsing Integer Overflow Remote Code Execution Vulnerability

GIMP ILBM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

GIMP XWD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability

Reolink Video Doorbell Wi-Fi DB_566128M5MP_W stores and transmits DDNS credentials in plaintext within its configuration and update scripts, allowing attackers to intercept or extract sensitive information

On affected platforms, restricted users could use SSH port forwarding to access host-internal services

Astro is a web framework that includes an image proxy

MLflow Weak Password Requirements Authentication Bypass Vulnerability

Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability

Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability

Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability

Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1

alexusmai laravel-file-manager 3

An issue in NCR Atleos Terminal Manager (ConfigApp) v3

GitLab has remediated an issue in EE affecting all versions from 17

DLL hijacking vulnerability in Evope Collector 1

Uncontrolled Resource Consumption vulnerability in Progress MOVEit Transfer (AS2 module)

Zitadel is open-source identity infrastructure software

A vulnerability was detected in ermig1979 AntiDupl up to 2

A use-after-free vulnerability exists in the XML parser functionality of GCC Productions Inc

An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc

An unquoted service path in Kingosoft Technology Ltd Kingo ROOT v1

On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges

FRRouting/frr from v4

FRRouting/frr from v4

FRRouting/frr from v4

FRRouting/frr from v4

An issue was discovered in Prevx v3

Unauthorized modification of arbitrary articles vulnerability exists in blog-vue-springboot

Incorrect access control in the /jshERP-boot/user/info interface of jshERP up to commit 90c411a allows attackers to access sensitive information via a crafted GET request

An issue was discovered in BESSystem BES Application Server thru 9

Starlette is a lightweight ASGI framework/toolkit

An issue discovered in Dyson App v6

To trigger the issue, three configuration parameters must have specific settings: "hostname-char-set" must be left at the default setting, which is "[^A-Za-z0-9

Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP

A vulnerability was identified in Campcodes Retro Basketball Shoes Online Store 1

A security flaw has been discovered in Campcodes Retro Basketball Shoes Online Store 1

A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1

A security vulnerability has been detected in Campcodes Retro Basketball Shoes Online Store 1

A flaw has been found in Serdar Bayram Ghost Hot Spot up to 20251014

A security flaw has been discovered in code-projects Simple Food Ordering System 1