Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a use...
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an unauthenticated attacker an unlimited number of passwor...
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions....
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions....
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions....
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` c...
PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-m...
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes...
AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint accepts POST data without origin, CSRF or parameter-type val...
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions....
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions....
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on...
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions....
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1...
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions....
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions....
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions....
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions....
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions....
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions....