Unauthenticated SQL Injection in Bookly <= 27.7 versions.

Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.

Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

A security flaw has been discovered in PHPGurukul Daily Expense Tracking System 1.1. Affected is an unknown function of the file /register.php. The manipulation of the argument email results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Use after free in Winlogon allows an authorized attacker to elevate privileges locally.

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

Integer overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.

Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.

Access of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This impacts the function opj_pi_initialise_encode in the library src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is 839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a patch to address this issue.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Cleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.

Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.