CVE Brief Security Intelligence

The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capability check on the Ajax::handle_request() function in all versions up to, and including, 2

A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service

A heap-based buffer overflow vulnerability exists in the PDF parsing of Foxit PDF Reader when processing specially crafted JBIG2 data

The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3

Memory safety bugs present in Firefox 146

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network

Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network

A use-after-free vulnerability exists in the AcroForm handling of Foxit PDF Reader and Foxit PDF Editor before 2025

A use-after-free vulnerability exists in the PDF file parsing of Foxit PDF Reader before 2025

A use-after-free vulnerability exists in the annotation handling of Foxit PDF Reader before 2025

The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3

ArcSearch for iOS versions prior to 1

ArcSearch for Android versions prior to 1

The Ocean Modal Window WordPress plugin before 2

The HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions from 2

MyHoard is a daemon for creating, managing and restoring MySQL backups

Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code

A Server-Side Template Injection (SSTI) vulnerability in the MDX Rendering Engine in Mintlify Platform before 2025-11-15 allows remote attackers to execute arbitrary code via inline JSX expressions in an MDX file

A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters

igmpproxy 0

There is a stack-based buffer overflow vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file

An authentication bypass vulnerability exists in Open-WebUI <=0

An insecure deserialization vulnerability exists in the download

An insecure deserialization vulnerability exists in the rss-mp3

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter

An unrestricted file upload vulnerability in Kentico Xperience allows authenticated users with 'Read data' permissions to upload arbitrary file types via MVC form file uploader components

File Thingie 2

BullWall Ransomware Containment contains excluded file paths, such as '$recycle

Successful exploitation of the vulnerability could allow an attacker with local network access to send a specially crafted URL to access certain administration functions without login credentials

BrainyCP 1

Dotclear 2

Flatnux 2021-03

Arcsoft PhotoStudio 6

OCS Inventory NG 2

AspEmail 5

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10

A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files

There is an out of bounds write vulnerability in NI LabVIEW in mgocre_SH_25_3!RevBL() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in LVResource::DetachResource() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in lvre!VisaWriteFromFile() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in lvre!DataSizeTDR() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in lvre!ExecPostedProcRecPost() when parsing a corrupted VI file

There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file

There is a use-after-free vulnerability in sentry!sentry_span_set_data() when parsing a corrupted VI file

Hubstaff 1

Codigo Markdown Editor 1

Weblate is a web based localization tool

Langflow is a tool for building and deploying AI-powered agents and workflows

EVE-NG 6

Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc

Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output

Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc

due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array

Dify v1

An issue was discovered in Open5GS 2

An issue was discovered in function LocalNode

The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests

A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2

A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2

A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms

A denial of service vulnerability in Kentico Xperience allows attackers to launch DoS attacks via specially crafted requests to the GetResource handler

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2

Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other

Mismatched length fields in Zlib compressed protocol headers may allow a read of uninitialized heap memory by an unauthenticated client

Turms AI-Serving module v0

The Takes web framework's TkFiles take thru 2

LDAP Tool Box Self Service Password 1

A vulnerability was identified in Campcodes Supplier Management System 1

A vulnerability was determined in code-projects Scholars Tracking System 1

A weakness has been identified in code-projects Scholars Tracking System 1

A security vulnerability has been detected in code-projects Scholars Tracking System 1

A vulnerability was detected in Campcodes Supplier Management System 1

A weakness has been identified in code-projects Simple Stock System 1

A security vulnerability has been detected in code-projects Simple Blood Donor Management System 1

A vulnerability was detected in code-projects Simple Blood Donor Management System 1

A vulnerability was identified in itsourcecode Student Management System 1

A security flaw has been discovered in code-projects Simple Stock System 1

A vulnerability was detected in D-Link DIR-605 202WWB03

An access control bypass vulnerability in Kentico Xperience allows administrators to modify global administrator user privileges via unauthorized requests

'

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation

BullWall Ransomware Containment does not entirely inspect a file to determine if it is ransomware

Cross-Site Request Forgery (CSRF) vulnerability in Restajet Information Technologies Inc

Langflow is a tool for building and deploying AI-powered agents and workflows