آخرین آسیب‌پذیری‌ها

Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler

Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses

WP Fastest Cache <= 1.5.3 - Unauthenticated Sensitive Information Exposure via Cached wp-activate.php Response

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS comma…

Octo STS discloses trust policy contents to unauthorized callers via Exchange error messages

labbench before 0.46.1 Deserialization of Untrusted Data via read() Pickle Auto-Dispatch

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only …

An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a file with a crafted filename to the /sync endpoint.

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies.

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive.

Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: fro…

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

NetX Secure DTLS server allocates a session for each new source before the cookie exchange and never reclaims it, so spoofed datagrams exhaust the session pool

NULL pointer dereference in the BSD raw IPv6 send path when the destination table is full

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.