Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) cont...
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these fil...
MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code inj...
MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resu...
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service accoun...
A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulat...
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: fro...
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions....
Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions....
Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions....
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions....
Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions....
Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions....
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions....
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions....
Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions....
Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions....
Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd. GP Premium allows Remote Code Inclusion. This issue affects GP Premium: from n/a through 2.5.5....
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes ...
Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions....
Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions....