CVE Database

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.

Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior …

Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality …

Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow …

Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An …

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations …

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users …

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification …

Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request bodies, allowing authenticated clients to choose which HuggingFace …

Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted() fails to cap the delay_before_return_html, mean_delay, and max_range fields …

Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

Editor PHP Object Injection in Zippy <= 1.7.0 versions.

Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to obtain sensitive information due to improper authentication.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a …