Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to th...
Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `...
DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parame...
Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities....
Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access....
Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding....
Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account....
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary fil...
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary files...
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files ...
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible...
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the applica...
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escapi...
Unauthenticated Cross Site Request Forgery (CSRF) in Avada Core <= 5.15.6 versions....
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions....
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions....
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions....
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions....
Unauthenticated SQL Injection in Bookly <= 27.7 versions....
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions....
Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions....
Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions....