CVEs published February 3, 2026
337 CVEs were published on February 3, 2026: 27 critical, 114 high. 1 is now in CISA KEV.
- Published
- 337
- Critical
- 27
- High
- 114
- Medium
- 155
- Low
- 41
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 125
Most affected products
- gunet openeclass
- 13
- Wikimedia Foundation MediaWiki
- 10
- craftcms commerce · craftcms/commerce
- 9
- moodle · moodle/moodle
- 9
- pearweb
- 9
- eProsima Fast-DDS
- 8
- TP-Link Systems Archer AX53
- 8
- Brocade Fabric OS
- 7
- HCL AION
- 7
- Wikimedia Foundation CheckUser
- 7
Critical 27
- CVE-2026-1633Synectix LAN 232 TRIO Missing Authentication for Critical FunctionSynectix LAN 232 TRIO
- CVE-2026-1632RISS SRL MOMA Seismic Station Missing Authentication for Critical FunctionRISS SRL MOMA Seismic Station
- CVE-2020-37092Netis E1+ 1.2.32533 - Backdoor Account (root)Netis Systems Co. Netis E1+
- CVE-2020-37071CraftCMS 3 vCard Plugin 1.0.0 - Remote Code ExecutionCraftCMS
- CVE-2026-1341Missing Authentication for Critical Function in Avation Light Engine ProAvation Light Engine Pro
- CVE-2026-25510CI4MS Vulnerable to Remote Code Execution (RCE) via Arbitrary File Creation and Save in File Editorci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-25150Prototype Pollution via FormData Processing in Qwik CityQwikDev qwik · @builder.io/qwik-city
- CVE-2025-65078Untrusted search path vulnerability in Embedded Solutions FrameworkLexmark MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CX…
- CVE-2026-1803Ziroom ZHOME A0101 Dropbear SSH Service default credentialsZiroom ZHOME A0101
- CVE-2026-25241PEAR is Vulnerable to SQL Injection in /get/<package>/<version> Endpointpearweb
- CVE-2026-25238PEAR is Vulnerable to SQL Injection in Bug Subscription Deletion via Weak Email Validationpearweb
- CVE-2026-25237PEAR is Vulnerable to PHP Code Execution via preg_replace /e in Bug Update Emailspearweb
- CVE-2026-1568Rapid7 InsightVM Signature Validation VulnerabilityRapid7 Vulnerability Management
- CVE-2025-5319SQLi in Emit Informatics' DIGITA Efficiency Management SystemEmit Informatics and Communication Technologies Industry an…
- CVE-2026-1432SQL injection (SQLi) on the Buroweb platformT-Systems Buroweb
- CVE-2026-24465Stack-based buffer overflow vulnerability exists in ELECOM wireless LAN access point devices.ELECOM CO. WAB-S733IW2-PD · ELECOM CO. WAB-S733IW-AC +4
- CVE-2026-24936An improper input validation vulnerability was found in ADM while joining a AD Domain.ASUSTOR ADM
- CVE-2025-10878A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26.Insaat Fikir Odalari AdminPando
- CVE-2025-57529YouDataSum CPAS Audit Management System <=v4.9 is vulnerable to SQL Injection in /cpasList/findArchiveReportByDah due to insufficient input
- CVE-2025-61506An issue was discovered in MediaCrush thru 1.0.1 allowing remote unauthenticated attackers to upload arbitrary files of any size to the /upl
- CVE-2025-63624SQL Injection vulnerability in Shandong Kede Electronics Co., Ltd IoT smart water meter monitoring platform v.1.0 allows a remote attacker t
- CVE-2025-67186TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability in the setUrlFilterRules interface of /lib/cste_modules/fir
- CVE-2025-67187A stack-based buffer overflow vulnerability was identified in TOTOLINK A950RG V4.1.2cu.5204_B20210112.
- CVE-2025-67188A buffer overflow vulnerability exists in TOTOLINK A950RG V4.1.2cu.5204_B20210112.
- CVE-2025-69970FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.fuxa-server
- CVE-2025-69971FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.@frangoteam/fuxa
- CVE-2025-70841Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configurati
High 114
- CVE-2026-24512ingress-nginx auth-method nginx configuration injectionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-1580ingress-nginx auth-method nginx configuration injectionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2020-37084School ERP Pro 1.0 Admin Profile Photo Upload Remote Code Execution VulnerabilityArox School ERP Pro
- CVE-2020-37097Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)EDIMAX Technology Co. EW-7438RPn Mini
- CVE-2020-37094EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical PasswordsEspoCRM
- CVE-2020-37093Netis E1+ 1.2.32533 - Unauthenticated WiFi Password LeakNetis Systems Co. Netis E1+
- CVE-2020-37090School ERP Pro 1.0 - Remote Code ExecutionArox School ERP Pro
- CVE-2020-37089School ERP Pro 1.0 - 'es_messagesid' SQL InjectionArox School ERP Pro
- CVE-2020-37088School ERP Pro 1.0 - Arbitrary File ReadArox School ERP Pro
- CVE-2020-37085VirtualTablet Server 3.0.2 - Denial of Service (PoC)SunnySideSoft VirtualTablet Server
- CVE-2020-37083addressbook 9.0.0.1 - 'id' SQL Injectionchatelao PHP Address Book
- CVE-2020-37082webERP 4.15.1 - Unauthenticated Backup File AccesswebERP
- CVE-2020-37081Fishing Reservation System 7.5 - 'uid' SQL InjectionFishing Reservation System
- CVE-2020-37080webTareas 2.0.p8 - Arbitrary File Deletionluiswang webTareas
- CVE-2020-37078i-doit Open Source CMDB 1.14.1 - Arbitrary File Deletioni-doit Open Source CMDB
- CVE-2020-37076Victor CMS 1.0 - 'post' SQL InjectionVictorAlagwu CMSsite
- CVE-2020-37075LanSend 3.2 - Buffer Overflow (SEH)LizardSystems LanSend
- CVE-2020-37074Remote Desktop Audit 2.3.0.157 - Buffer Overflow (SEH)LizardSystems Remote Desktop Audit
- CVE-2020-37073Victor CMS 1.0 - Authenticated Arbitrary File UploadVictorAlagwu CMSsite
- CVE-2020-37070CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR)CloudMe
- CVE-2020-37069Konica Minolta FTP Utility 1.0 - 'NLST' Denial of ServiceKonica Minolta FTP Utility
- CVE-2020-37068Konica Minolta FTP Utility 1.0 - 'LIST' Denial of ServiceKonica Minolta FTP Utility
- CVE-2020-37067Filetto 1.0 - 'FEAT' Denial of ServiceUtillyty Filetto
- CVE-2020-37066GoldWave 5.70 – Buffer Overflow (SEH Unicode)GoldWave
- CVE-2020-37065StreamRipper32 2.6 - Buffer OverflowStreamRipper32
- CVE-2019-25260OXID eShop 6.3.4 - 'sorting' SQL InjectionOXID-eSales OXID eShop
- CVE-2026-25223Fastify's Content-Type header tab character allows body validation bypassfastify
- CVE-2026-1862Type Confusion in V8 in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2026-1861Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2026-24887Claude Code has a Command Injection in find Command Bypasses User Approval Promptanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-24053Cluade Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writesanthropics claude-code · @anthropic-ai/claude-code
- CVE-2026-24052Claude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domainsanthropics claude-code · @anthropic-ai/claude-code
- CVE-2025-65077Relative path traversal vulnerability in Embedded Solutions FrameworkLexmark MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CX…
- CVE-2026-24149NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injeNVIDIA Megatron-LM
- CVE-2025-62799FastDDS's heap buffer overflow in RTPS DATA_FRAG enables unauthenticated DoS (potential RCE)eProsima Fast-DDS
- CVE-2026-25615Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.Blesta
- CVE-2026-25614Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.Blesta
- CVE-2026-24441Tenda AC7 Transmits Admin Credentials Without HTTPS ProtectionShenzhen Tenda Technology Co. Tenda AC7
- CVE-2025-62600eprosima Fast DDS affected by Out-of-Memory in readBinaryPropertySeq via Manipulated DATA Submessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2025-62673Heap-based Buffer Overflow Vulnerability in Archer AX53 and AX12TP-Link Systems Archer AX53 · TP-Link Systems Archer AX12
- CVE-2025-62501SSH Hostkey Misconfiguration Vulnerability in Archer DevicesTP-Link Systems Archer AX53 · TP-Link Systems Archer BE3600
- CVE-2025-62405Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-62404Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-61983Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-61944Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-59487Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-59482Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-58455Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2025-58077Heap-based Buffer Overflow Vulnerability in TP-Link Archer AX53TP-Link Systems Archer AX53
- CVE-2026-25502iccDEV is vulnerable to stack-buffer-overflow in icFixXml()InternationalColorConsortium iccDEV
- CVE-2026-25503iccDEV Has Type Confusion in CIccTagEmbeddedHeightImage::Validate()InternationalColorConsortium iccDEV
- CVE-2026-25239PEAR is Vulnerable to SQL Injection in apidoc_queue Insert via Unescaped Filenamepearweb
- CVE-2026-25235PEAR Has a Predictable Verification Hash in Election Account Requestspearweb
- CVE-2026-25233PEAR Has a Roadmap Authorization Bypass via Operator Precedence Bugpearweb
- CVE-2025-62599eprosima Fast DDS affected by Out-of-Memory in readPropertySeq via Manipulated DATA Submessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2026-24669Open eClass Insecure Password Reset Token Reuse Enables Account Takeovergunet openeclass
- CVE-2026-24665Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) via Student Assignment Uploadgunet openeclass
- CVE-2026-24773Open eClass Unauthenticated IDOR Allows Access to Arbitrary User Filesgunet openeclass
- CVE-2026-24672Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in User Profile Fieldsgunet openeclass
- CVE-2020-37116GUnet OpenEclass 1.7.3 E-learning platform - phpMyAdmin Remote AccessGUnet OpenEclass
- CVE-2020-37115GUnet OpenEclass 1.7.3 E-learning platform - Plaintext Password StorageGUnet OpenEclass
- CVE-2020-37113GUnet OpenEclass 1.7.3 E-learning platform - File Upload Extension BypassGUnet OpenEclass
- CVE-2020-37112GUnet OpenEclass 1.7.3 E-learning platform - 'month' SQL InjectionGUnet OpenEclass
- CVE-2020-3711060CycleCMS 2.5.2 - 'news.php' SQL Injection VulnerabilityDavidvg 60CycleCMS
- CVE-2020-37108PhpIX 2012 Professional - 'id' SQL InjectionAllHandsMarketing PhpIX 2012 Professional
- CVE-2020-37105PMB 5.6 - 'logid' SQL Injectionredmine PMB
- CVE-2026-21862RustFS sourceIp bypass via spoofed X-Forwarded-For/Real-IP headersrustfs
- CVE-2025-65017Decidim's private data exports can lead to data leaksdecidim · decidim-core
- CVE-2020-37102Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service PathLavasoft Web Companion
- CVE-2020-37101VPN unlimited 6.1 - Unquoted Service PathVpnunlimitedapp VPN unlimited
- CVE-2020-37100Sync Breeze Enterprise 12.4.18 - Unquoted Service PathSyncBreeze Sync Breeze Enterprise
- CVE-2020-37099Disk Savvy Enterprise 12.3.18 - 'disksvs.exe' Unquoted Service PathDiskSavvy Disk Savvy Enterprise
- CVE-2020-37098Disk Sorter Enterprise 12.4.16 - Unquoted Service PathDiskSorter Disk Sorter Enterprise
- CVE-2019-25261AnyDesk 5.4.0 - Unquoted Service PathAnyDesk
- CVE-2025-14550Potential denial-of-service vulnerability via repeated headers when using ASGIdjangoproject Django · djangoproject asgiref +1
- CVE-2026-1285Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methodsdjangoproject Django · django
- CVE-2026-25027WordPress Unicamp theme <= 2.7.1 - Local File Inclusion vulnerabilityThemeMove Unicamp
- CVE-2026-25022WordPress KiviCare plugin <= 3.6.16 - SQL Injection vulnerabilityIqonic Design KiviCare
- CVE-2026-24954WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerabilitymagepeopleteam WpEvently
- CVE-2025-7760Reflected XSS in Ofisimo's Association Web Package FloraOfisimo Web-Based Software Technologies Association Web Pac…
- CVE-2025-6397XSS in Ankara Hosting's web siteAnkara Hosting Website Design Website Software
- CVE-2025-67853Moodle: moodle: brute-force facilitation due to missing rate limiting in confirmation email servicemoodle · moodle/moodle
- CVE-2025-67850Moodle: moodle: cross-site scripting vulnerability via inadequate input filtering in formula editormoodle · moodle/moodle
- CVE-2025-67849Moodle: moodle: cross-site scripting (xss) via improper sanitization of ai prompt responsesmoodle · moodle/moodle
- CVE-2025-67848Moodle: moodle: authentication bypass via lti provider allows suspended users to gain unauthorized access.moodle · moodle/moodle
- CVE-2025-59902HTML injection in NICE ChatNICE Chat
- CVE-2025-8461Reflected XSS in Seres Software's syWEBSeres Software syWEB
- CVE-2025-8456Reflected XSS in Kod8 Software's Kod8 Individual and SME WebsiteKod8 Software Technologies Trade Ltd. Kod8 Individual and S…
- CVE-2026-1730OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Uploadskirridsystems OS DataHub Maps
- CVE-2026-1375Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletionthemeum Tutor LMS – eLearning and online course solution
- CVE-2025-8590Information Disclosure in AKCE Software's SKSProAKCE Software Technology R&D Industry and Trade SKSPro
- CVE-2025-8589Reflected XSS in AKCE Software's SKSProAKCE Software Technology R&D Industry and Trade SKSPro
- CVE-2026-22550OS command injection vulnerability exists in ELECOM wireless LAN products.ELECOM CO. WRC-X6000XS-G · ELECOM CO. WRC-X6000XST-G +13
- CVE-2026-1058Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden FieldForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-1065Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG fileForm Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…
- CVE-2026-0617LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site ScriptingLatePoint – Calendar Booking Plugin for Appointments and Ev…
- CVE-2026-24694The installer for Roland Cloud Manager ver.3.1.19 and prior insecurely loads Dynamic Link Libraries (DLLs), which could allow an attacker toRoland Cloud Manager
- CVE-2025-9711Privilege escalation in Brocade Fabric OS before 9.2.1c3, and 9.2.2 though 9.2.2bBrocade Fabric OS
- CVE-2026-0383Information disclosure in Brocade Fabric OS before 9.2.1c2, 9.2.2 through 9.2.2a and 10.0.0Brocade Fabric OS
- CVE-2026-24933An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server.ASUSTOR ADM
- CVE-2026-24932An improper certificate validation vulnerability was found in ADM while updating the DDNS settings.ASUSTOR ADM
- CVE-2025-58383Privilege escalation via bind command in Brocade Fabric OSBrocade Fabric OS
- CVE-2025-58382Privilege escalation in Brocade Fabric before 9.2.1c2 and 9.2.2 through 9.2.2aBrocade Fabric OS
- CVE-2025-15556Notepad++ < 8.8.9 WinGUp Updater Lacks Update Integrity Verificationnotepad-plus-plus
- CVE-2025-12773Plain password is generated in the audit logs while executing update-reports-purge-settings.sh script with Brocade SANnav before 2.4.0aBrocade SANnav
- CVE-2025-59439An issue was discovered in Samsung Mobile Processor, Wearable Processor and Modem Exynos 980, 990, 850, 1080, 9110, W920, W930, W1000 and Mo
- CVE-2025-60865Insecure Permissions vulnerability in avanquest Driver Updater v.9.1.57803.1174 allows a local attacker to escalate privileges via the Drive
- CVE-2025-65875An arbitrary file upload vulnerability in the AddFont() function of FPDF v1.86 and earlier allows attackers to execute arbitrary code via up
- CVE-2025-66374CyberArk Endpoint Privilege Manager Agent through 25.10.0 allows a local user to achieve privilege escalation through policy elevation of an
- CVE-2025-69875A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient validation of restore p
- CVE-2025-69981FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.fuxa-server
- CVE-2025-69983FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.fuxa-server
- CVE-2025-70560Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality.boltz
- CVE-2025-70758chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_validate.php.
Medium, low and unrated 196
- CVE-2026-1813bolo-blog bolo-solo FreeMarker Template PicUploadProcessor.java unrestricted uploadbolo-blog bolo-solo
- CVE-2026-1812bolo-blog bolo-solo Filename BackupService.java importFromCnblogs path traversalbolo-blog bolo-solo
- CVE-2026-1755Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site ScriptingMenu Icons by ThemeIsle
- CVE-2026-24514ingress-nginx Admission Controller denial of serviceKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2026-24513ingress-nginx auth-url protection bypassKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2025-33081Multiple Vulnerabilities in IBM Concert Software.IBM Concert
- CVE-2025-36033IBM Engineering Lifecycle Management - Global Configuration Management is vulnerable to cross-site scriptingIBM Engineering Lifecycle Management - Global Configuration…
- CVE-2020-37087Easy Transfer 1.7 for iOS - Persistent Cross-Site ScriptingRubikon Teknoloji Easy Transfer
- CVE-2025-36094Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for January 2026.IBM Cloud Pak for Business Automation
- CVE-2020-37096Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)EDIMAX Technology Co. EW-7438RPn Mini
- CVE-2020-37091Maian Support Helpdesk 4.3 - Cross-Site Request Forgery (Add Admin)Maian Media Maian Support Helpdesk
- CVE-2020-37086Easy Transfer 1.7 for iOS - Directory TraversalRubikon Teknoloji Easy Transfer
- CVE-2020-37077Booked Scheduler 2.7.7 - Authenticated Directory TraversalTwinkle Toes Software Booked Scheduler
- CVE-2020-37072Victor CMS 1.0 - 'comment_author' Persistent Cross-Site ScriptingVictorAlagwu CMSsite
- CVE-2026-1811bolo-blog bolo-solo Filename BackupService.java importFromMarkdown path traversalbolo-blog bolo-solo
- CVE-2026-25224Fastify Vulnerable to DoS via Unbounded Memory Allocation in sendWebStreamfastify
- CVE-2026-25509CI4MS Vulnerable to User Email Enumeration via Password Reset Flowci4-cms-erp ci4ms · ci4-cms-erp/ci4ms
- CVE-2026-25148Qwik SSR XSS via Unsafe Virtual Node SerializationQwikDev qwik · @builder.io/qwik-city
- CVE-2026-25151Qwik City has a CSRF Protection Bypass via Content-Type Header ValidationQwikDev qwik · @builder.io/qwik-city
- CVE-2026-25155[qwik-city] CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)QwikDev qwik · @builder.io/qwik-city
- CVE-2026-25149Qwik City Open Redirect via fixTrailingSlashQwikDev qwik · @builder.io/qwik-city
- CVE-2025-65081Out-of-bounds read vulnerability in Postscript interpreterLexmark MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CX…
- CVE-2025-65080Type confusion vulnerability in Postscript interpreterLexmark MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CX…
- CVE-2026-1810bolo-blog bolo-solo ZIP File BackupService.java unpackFilteredZip path traversalbolo-blog bolo-solo
- CVE-2025-65079Heap-based buffer overflow vulnerability in Postscript interpreterLexmark MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CX…
- CVE-2026-1801Libsoup: libsoup: http request smuggling via malformed chunk headersRed Hat Enterprise Linux
- CVE-2025-64438Fast-DDS: Unbounded GAP range triggers OOM DoS under RELIABLE QoSeProsima Fast-DDS
- CVE-2025-64098FastDDS has Out-of-memory in readOctetVector via Manipulated DATA Submessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2025-62603FastDDS has Out-of-memory while parsing GenericMessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2026-25616Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.Blesta
- CVE-2025-62602FastDDS has heap buffer overflow in readData via Manipulated DATA Submessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2025-62601FastDDS has heap buffer overflow in readString via Manipulated DATA Submessage when DDS Security is enabledeProsima Fast-DDS
- CVE-2026-24434Tenda AC7 Web Interface Lacks CSRF Protections for Admin ActionsShenzhen Tenda Technology Co. Tenda AC7
- CVE-2026-24427Tenda AC7 Exposes Admin Credentials in Configuration ResponsesShenzhen Tenda Technology Co. Tenda AC7
- CVE-2026-24426Tenda AC7 Reflected XSS via Web Interface Output EncodingShenzhen Tenda Technology Co. Tenda AC7
- CVE-2026-1802Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injectionZiroom ZHOME A0101
- CVE-2026-25240PEAR is Vulnerable to SQL Injection in user::maintains() Role IN() Filterpearweb
- CVE-2026-25236PEAR is Vulnerable to SQL Injection in Damblan_Karma IN() Query via Literal Substitutionpearweb
- CVE-2026-25234PEAR is Vulnerable to SQL Injection in Category Deletionpearweb
- CVE-2025-52631HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability.HCL AION
- CVE-2025-52623HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerabilityHCL AION
- CVE-2026-25522Craft Commerce has Stored XSS in Shipping Zone (Name & Description) Fields Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25490Craft Commerce has Stored XSS in Inventory Location Address Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25489Craft Commerce has Stored XSS in Tax Zones (Name & Description) Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25488Craft Commerce has Stored XSS in Tax Categories (Name & Description) Fields Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25487Craft CMS has Stored XSS in Tax Rates Name Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25486Craft Commerce has Stored XSS in Shipping Methods Name Field Leading to Potential Privilege Escalationcraftcms commerce · craftcms/commerce
- CVE-2026-25485Craft Commerce has Stored XSS in Shipping Categories (Name & Description) Fields Leading to Potential Privilege Escalationcraftcms commerce · craftcms/composer
- CVE-2025-52628HCL AION is susceptible to Missing SameSite vulnerabilityHCL AION
- CVE-2026-25484Craft Commerce has Stored XSS in Product Type Namecraftcms commerce · craftcms/commerce
- CVE-2026-25483Craft Commerce has Stored XSS via Order Status Message with potential database exfiltrationcraftcms commerce · craftcms/commerce
- CVE-2026-0620L2TP over IPSec Encryption Failure on ArcherAXE75TP-Link Systems AXE75
- CVE-2026-25482Craft Commerce has Stored DOM XSS in Order Status Name (Reflects in "Recent Orders" Dashboard Widget)craftcms commerce · craftcms/commerce
- CVE-2025-52633HCL AION is susceptible to Missing Content-Security-PolicyHCL AION
- CVE-2025-52629HCL AION is susceptible to Missing Content-Security-PolicyHCL AION
- CVE-2025-52626HCL AION is susceptible to Potential Command Injection vulnerabilityHCL AION
- CVE-2025-52627HCL AION is susceptible to Incorrect Permission Assignment for Critical ResourceHCL AION
- CVE-2026-22228Improper Input Validation Leading to DoS on TP-Link Archer BE230TP-Link Systems Archer BE230
- CVE-2026-22220Improper Input Validation Leading to DoS on TP-Link Archer BE230TP-Link Systems Archer BE230
- CVE-2026-24668Open eClass Broken Access Control Allows Students to Add Content to Course Unitsgunet openeclass
- CVE-2026-24667Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Accessgunet openeclass
- CVE-2026-24666Open eClass is Vulnerable to CSRF in Teacher-Restricted Endpoints Allows Unauthorized Actionsgunet openeclass
- CVE-2026-24774Open eClass Business Logic Flaw Allows Students to Mark Attendance in Expired Activitiesgunet openeclass
- CVE-2026-24674Open eClass is Vulnerable to Reflected Cross-Site Scripting (XSS) in Multiple Endpointsgunet openeclass
- CVE-2026-24673Open eClass Has File Upload Filter Bypass via ZIP Archive Extractiongunet openeclass
- CVE-2026-24671Open eClass is Vulnerable to Stored Cross-Site Scripting (XSS) in Multiple High-Privilege User Fieldsgunet openeclass
- CVE-2026-24670Open eClass Has Broken Access Control in Course Units Module Allows Students to Create Unitsgunet openeclass
- CVE-2026-24664Open eClass is Vulnerable to Username Enumeration via Login Response Discrepanciesgunet openeclass
- CVE-2020-37114GUnet OpenEclass 1.7.3 E-learning platform - Information DisclosureGUnet OpenEclass
- CVE-2020-3711160CycleCMS 2.5.2 - 'news.php' Cross-site Scripting (XSS) VulnerabilityDavidvg 60CycleCMS
- CVE-2020-37103DotNetNuke 9.5 - Persistent Cross-Site ScriptingDnnsoftware DotNetNuke
- CVE-2019-25265Online Inventory Manager 3.2 - Persistent Cross-Site ScriptingBigprof Online Inventory Manager
- CVE-2019-25264Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site ScriptingSnipeitapp IT Open Source Asset Management
- CVE-2019-25263Zendesk App SweetHawk Survey 1.6 - Persistent Cross-Site ScriptingZendesk App SweetHawk Survey
- CVE-2026-24762RustFS Logs Sensitive Credentials in Plaintextrustfs
- CVE-2026-23794Apache Syncope: Reflected XSS on Enduser LoginApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2026-23795Apache Syncope: Console XXE on Keymaster parametersApache Software Foundation Apache Syncope · org.apache.sync…
- CVE-2026-1814Rapid7 Nexpose Insecure Java Keystore Password GenerationRapid7 InsightVM/Nexpose
- CVE-2026-1312Potential SQL injection via QuerySet.order_by and FilteredRelationdjangoproject Django · django
- CVE-2026-1287Potential SQL injection in column aliases via control charactersdjangoproject Django · django
- CVE-2026-1207Potential SQL injection via raster lookups on PostGISdjangoproject Django · django
- CVE-2025-13473Username enumeration through timing difference in mod_wsgi authentication handlerdjangoproject Django · django
- CVE-2026-25036WordPress Passster plugin <= 4.2.25 - Broken Access Control vulnerabilityWP Chill Passster
- CVE-2026-25028WordPress ElementInvader Addons for Elementor plugin <= 1.4.1 - Broken Access Control vulnerabilityElement Invader ElementInvader Addons for Elementor
- CVE-2026-25024WordPress ThirstyAffiliates plugin <= 3.11.9 - Cross Site Request Forgery (CSRF) vulnerabilityBlair Williams ThirstyAffiliates
- CVE-2026-25023WordPress Run Contests, Raffles, and Giveaways with ContestsWP plugin <= 2.0.7 - Sensitive Data Exposure vulnerabilitymdedev Run Contests, Raffles, and Giveaways with ContestsWP
- CVE-2026-25021WordPress Mizan Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerabilityMizan Themes Mizan Demo Importer
- CVE-2026-25020WordPress WP Sync for Notion plugin <= 1.7.0 - Broken Access Control vulnerabilityWP connect WP Sync for Notion
- CVE-2026-25019WordPress Atarim plugin <= 4.3.1 - Broken Access Control vulnerabilityVito Peleg Atarim
- CVE-2026-25016WordPress Nelio Popups plugin <= 1.3.5 - Broken Access Control vulnerabilityNelio Software Nelio Popups
- CVE-2026-25015WordPress UsersWP plugin <= 1.2.53 - Cross Site Request Forgery (CSRF) vulnerabilityStiofan UsersWP
- CVE-2026-25014WordPress Enter Addons plugin <= 2.3.2 - Cross Site Request Forgery (CSRF) vulnerabilitythemelooks Enter Addons
- CVE-2026-25012WordPress WP Bannerize Pro plugin <= 1.11.0 - Broken Access Control vulnerabilitygfazioli WP Bannerize Pro
- CVE-2026-25011WordPress WP Custom Admin Interface plugin <= 7.41 - Broken Access Control vulnerabilityNorthern Beaches Websites WP Custom Admin Interface
- CVE-2026-25010WordPress Share This Image plugin <= 2.09 - Broken Access Control vulnerabilityILLID Share This Image
- CVE-2026-24998WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerabilityWPMU DEV - Your All-in-One WordPress Platform Hustle
- CVE-2026-24997WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerabilityWired Impact Volunteer Management
- CVE-2026-24996WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerabilityWPElemento Importer
- CVE-2026-24995WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerabilityIulia Cazan Latest Post Shortcode
- CVE-2026-24994WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2026-24992WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerabilityWPFactory Advanced WooCommerce Product Sales Reporting
- CVE-2026-24991WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerabilityHT Plugins Extensions For CF7
- CVE-2026-24990WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerabilityFahad Mahmood WP Docs
- CVE-2026-24988WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerabilityBrian Hogg The Events Calendar Shortcode & Block
- CVE-2026-24986WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerabilitywp.insider Simple Membership WP user Import
- CVE-2026-24985WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerabilityapproveme WP Forms Signature Contract Add-On
- CVE-2026-24984WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerabilityBrecht Visual Link Preview
- CVE-2026-24982WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerabilityBrainstorm Force Spectra
- CVE-2026-24967WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerabilityameliabooking Amelia
- CVE-2026-24966WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityCopyscape Premium
- CVE-2026-24965WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2026-24962WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerabilityBrainstorm Force Sigmize
- CVE-2026-24961WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerabilityThemeGoods Grand Blog
- CVE-2026-24958WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetElements For Elementor
- CVE-2026-24957WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerabilityWP Chill Strong Testimonials
- CVE-2026-24952WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2026-24951WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerabilitySaad Iqbal myCred
- CVE-2026-24947WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerabilityLA-Studio Element Kit for Elementor
- CVE-2026-24945WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerabilityThemefic Ultimate Addons for Contact Form
- CVE-2026-24942WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerabilitymagepeopleteam WpEvently
- CVE-2026-24940WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerabilityThemefic Travelfic Toolkit
- CVE-2026-24939WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerabilityWP Chill Modula Image Gallery
- CVE-2026-24938WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerabilityAjay Better Search
- CVE-2026-1664Insecure Direct Object Reference (IDOR) via Header-Based Email Routingagents
- CVE-2025-11598Exposure of Confidential Information in mObywatel applicationCentralny Ośrodek Informatyki mObywatel
- CVE-2025-67857Moodle: moodle: data exposure of user identifiers in urlsmoodle · moodle/moodle
- CVE-2025-67856Moodle: moodle: privilege escalation via incomplete role checks in badge awardingmoodle · moodle/moodle
- CVE-2025-67855Mooodle: mooodle: information disclosure and script execution via reflected cross-site scriptingmoodle · moodle/moodle
- CVE-2025-67852Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.moodle · moodle/moodle
- CVE-2025-67851Moodle: moodle: formula injection allows arbitrary formula execution via unescaped data exportmoodle · moodle/moodle
- CVE-2025-41065Stored Cross-Site Scripting (XSS) in LUNA from Luna ImagingLuna Imaging LUNA
- CVE-2026-1592Stored XSS via Create New Layer Field found in Foxit PDF Editor CloudFoxit Software pdfonline.foxit.com
- CVE-2026-1591Stored XSS via Attachments Feature in https://pdfonline.foxit.com/Foxit Software pdfonline.foxit.com
- CVE-2026-1371Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Actionthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-24449For WRC-X1500GS-B and WRC-X1500GSA-B, the initial passwords can be calculated easily from the system information.ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B
- CVE-2026-20704Cross-site request forgery vulnerability exists in ELECOM wireless LAN products.ELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13
- CVE-2026-1447Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scriptinggetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2026-1210Happy Addons for Elementor <= 3.20.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_elementor_data' Meta Fieldthehappymonster Happy Addons for Elementor
- CVE-2025-58381Directory transversal vulnerability in Brocade Fabric OS before 9.2.1c2 and 9.2.2 through 9.2.2a using various shell commandsBrocade Fabric OS
- CVE-2026-0950Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Databrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2025-14274Unlimited Elements for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Border Hero Widgetunitecms Unlimited Elements For Elementor
- CVE-2025-58380Directory transversal vulnerability in Brocade Fabric OS before 9.2.1 using grep commandBrocade Fabric OS
- CVE-2026-0909WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameteralimir WP ULike – Like & Dislike Buttons for Engagement and…
- CVE-2026-1788Buffer Overflow in Xquic ServerXquic Project Xquic Server
- CVE-2026-24935An improper certificate validation vulnerability was found in a third-party NAT traversal module.ASUSTOR ADM
- CVE-2026-24934An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address.ASUSTOR ADM
- CVE-2025-58379Password Exposure in Brocade Fabric OSBrocade Fabric OS
- CVE-2025-67481mw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesWikimedia Foundation MediaWiki
- CVE-2025-67482Lua segfault in unpack()Wikimedia Foundation Scribunto · Wikimedia Foundation luasa…
- CVE-2025-12774SQL queries with sensitive information printed in logs with Brocade SANnav before 3.0Brocade SANnav
- CVE-2025-67483Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levelsWikimedia Foundation MediaWiki
- CVE-2025-67484Action API xslt option allows JavaScript execution by administrators who are not interface administratorsWikimedia Foundation MediaWiki
- CVE-2025-67480list=allrevisions can be used to bypass Extension:LockdownWikimedia Foundation MediaWiki
- CVE-2025-67475Stored XSS through edit summaries in MW CoreWikimedia Foundation MediaWiki
- CVE-2025-67476Importing leaks IP address of importer via EventStreamsWikimedia Foundation MediaWiki
- CVE-2025-67477Stored XSS through a system message in Special:ApiSandboxWikimedia Foundation MediaWiki
- CVE-2025-67478Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"Wikimedia Foundation CheckUser
- CVE-2025-67479Magic word replacement in legacy parser allows using reserved data attributes through wikitextWikimedia Foundation MediaWiki · Wikimedia Foundation Cite
- CVE-2025-61654UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanksWikimedia Foundation Thanks
- CVE-2025-61655Stored XSS through system messages in VisualEditorWikimedia Foundation VisualEditor
- CVE-2025-61656XSS when pasting into VEWikimedia Foundation VisualEditor
- CVE-2025-61657Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector.Wikimedia Foundation Vector
- CVE-2025-61658Special:GlobalContributions shows edits on wikis the viewer doesn't have access toWikimedia Foundation CheckUser
- CVE-2025-61653Extension:TextExtracts does not check for authorizeRead when returning extractsWikimedia Foundation TextExtracts
- CVE-2025-61652Action API discussiontoolspageinfo does not check for authorizeRead for the pageWikimedia Foundation DiscussionTools
- CVE-2025-61651i18n XSS through Special:CheckUser CheckUser helperWikimedia Foundation CheckUser
- CVE-2025-11173Reauth for enabling 2FA can be bypassed by submitting a formWikimedia Foundation OATHAuth
- CVE-2025-11261Stored i18n XSS exposed by security patch for T402077Wikimedia Foundation MediaWiki
- CVE-2025-61648Stored XSS through system messages in CheckUserWikimedia Foundation CheckUser
- CVE-2025-61649UserInfoCard: Check that performing user has permission to view log entries for number of past blocksWikimedia Foundation CheckUser
- CVE-2025-61650UserInfoCard is vulnerable to message key stored XSSWikimedia Foundation CheckUser
- CVE-2025-61645CodexTablePager has i18n XSSWikimedia Foundation MediaWiki
- CVE-2025-61646Watchlist group mode reveals authors of edits with hidden authorshipWikimedia Foundation MediaWiki
- CVE-2025-61647UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rightsWikimedia Foundation CheckUser
- CVE-2025-46651Tiny File Manager through 2.6 contains a server-side request forgery (SSRF) vulnerability in the URL upload feature.
- CVE-2025-58340An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58341An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58342An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58343An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58344An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58345An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58346An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58347An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-58348An issue was discovered in the Wi-Fi driver in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480
- CVE-2025-63372Articentgroup Zip Rar Extractor Tool 1.345.93.0 is vulnerable to Directory Traversal.
- CVE-2025-65923A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Upda
- CVE-2025-65924ERPNext thru 15.88.1 does not sanitize or remove certain HTML tags specifically `<a>` hyperlinks in fields that are intended for plain text.
- CVE-2025-67189A buffer overflow vulnerability exists in the setParentalRules interface of TOTOLINK A950RG V4.1.2cu.5204_B20210112.
- CVE-2025-69429The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to
- CVE-2025-69430An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12),
- CVE-2025-69431The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following.
- CVE-2025-69848NetBox is an open-source infrastructure resource modeling and IP address management platform.
- CVE-2025-70311JEEWMS 1.0 is vulnerable to SQL Injection.
- CVE-2025-70559pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism.pdfminer-six
- CVE-2025-70849Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST request to the /storgithub.com/stefanprodan/podinfo
- CVE-2025-71179Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to the /academy/blogs en