CLEANSTART-2026-FC20847 Security fix for CVE-2025-4947 applied in: curl 8.14.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CLEANSTART-2026-YC05676 Security fix for CVE-2025-5025 applied in: curl 8.14.0-r0

Security vulnerability affects the curl package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-59527

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-59527

Unauthenticated SQL Injection in MapSVG = 8.14.0 versions...

CVE-2025-9205

CVE-2025-9205 affects MapSVG Lite for WordPress up to version 8.14.0. The issue is a stored XSS vulnerability caused by insufficient input sanitization and output escaping on user-supplied map options attributes. It can be exploited by authenticated attackers with contributor-level access and abo...

EUVD-2026-48220

Administrator Arbitrary File Upload in MapSVG = 8.14.0 versions...

CVE-2026-65451 WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

Contributor SQL Injection in MapSVG = 8.14.0 versions...

EUVD-2026-48215

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-65449 WordPress MapSVG plugin <= 8.14.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...

PT-2026-63873

Contributor SQL Injection in MapSVG = 8.14.0 versions...

CVE-2026-65450: Improper Neutralization of Special Elements used in an SQL Command

Contributor SQL Injection in MapSVG = 8.14.0 versions...

PT-2026-63872

Contributor Cross Site Scripting XSS in MapSVG = 8.14.0 versions...

WordPress MapSVG plugin <= 8.14.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin MapSVG versions = 8.14.0...

PT-2026-61846

The MapSVG plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the SVGFile constructor in all versions up to, and including, 8.14.0 This is due to an incorrect conditional check that prevents file validation from taking place. This makes it possible...

Fedora 43 : calibre (2025-355be35bb1)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-355be35bb1 advisory. Update to 8.14.0. Fixes rhbz2413304 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

EUVD-2025-38333

calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve...

CVE-2025-64486 calibre is vulnerable to arbitrary code execution when opening FB2 files

calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files, allowing an attacker to write arbitrary files on the filesystem when viewing or converting a malicious FictionBook file. This can be leveraged to achieve...

SUSE-SU-2025:20824-1 Security update for curl

This update for curl fixes the following issues: - CVE-2025-9086: Fixed Out of bounds read for cookie path bsc1249191 - CVE-2025-10148: Predictable WebSocket mask bsc1249348 - Fix the --ftp-pasv option in curl v8.14.1 bsc1246197 - tooloperate: fix return code when --retry is used but not triggere...

Security update for curl

This update for curl fixes the following issues: CVE-2025-9086: Fixed Out of bounds read for cookie path bsc1249191 CVE-2025-10148: Predictable WebSocket mask bsc1249348 Fix the --ftp-pasv option in curl v8.14.1 bsc1246197 tooloperate: fix return code when --retry is used but not triggered...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data through the decrypt function in CookieStore.php. An attacker can execute arbitrary code or cause a denial of service by sending a specially crafted cookie containing malicious serialized data which are...