CVE-2025-4144

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27...

SUSE CVE-2025-23394

A UNIX Symbolic Link Symlink Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1...

CVE-2025-46457

Cross-Site Request Forgery CSRF vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through = 2.1...

CVE-2025-27333

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through = 2.1...

CVE-2025-27288

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BjornW File Icons file-icons allows Reflected XSS.This issue affects File Icons: from n/a through = 2.1...

CVE-2025-39421

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through = 2.1...

CVE-2025-46495

Cross-Site Request Forgery CSRF vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through = 2.1...

CVE-2025-46457

Cross-Site Request Forgery CSRF vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS Block: from n/a through = 2.1...

CVE-2025-46457

CVE-2025-46457 affects WordPress plugin Wp Custom CMS Block (

CVE-2025-46495 WordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through = 2.1...

CVE-2025-46495

Summary: CVE-2025-46495 describes a Cross-Site Request Forgery (CSRF) that enables Stored XSS in the WordPress Drop Caps plugin (versions n/a through 2.1). Affected product/versions (as provided): Drop Caps plugin for WordPress, affected up to and including version 2.1; version range starting at ...

PT-2025-17802 · Unknown · Tomontoast Drop Caps

Name of the Vulnerable Software and Affected Versions: tomontoast Drop Caps versions n/a through 2.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

CVE-2025-39421

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through = 2.1...

CVE-2025-27333 WordPress Protected wp-login Plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alvego Protected wp-login protected-wp-login allows Reflected XSS.This issue affects Protected wp-login: from n/a through = 2.1...

CVE-2025-39421 WordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons allows Stored XSS. This issue affects WP Sticky Side Buttons: from n/a through 2.1...

CVE-2025-43708

VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set2' is used, aka an "insecure deserialization" issue...

PT-2025-16925 · Visicut · Visicut

Name of the Vulnerable Software and Affected Versions: VisiCut version 2.1 Description: The issue is related to insecure deserialization, where VisiCut 2.1 allows stack consumption via an XML document with nested set elements. This can be demonstrated by a java.util.HashMap StackOverflowError whe...

CVE-2025-43708

CVE-2025-43708 affects Visicut 2.1. The vulnerability arises from insecure deserialization of XML documents containing nested set elements, which can trigger a java.util.HashMap StackOverflowError (e.g., when reference is '../../../set/set[2]'), leading to stack consumption. Multiple sources corr...

Advisory ROSA-SA-2025-2833

Software: binutils 2.30 OS: ROSA Virtualization 2.1 packageevrstring: binutils-2.30-125.0.1.rv3 CVE-ID: CVE-2018-12699 BDU-ID: 2021-01389 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the finishstab function of the stabs.c file of the Binutils program development kit is related to an operation...

CVE-2025-31813

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Website366.com WPSHARE247 Elementor Addons wpshare247-elementor-addons allows Stored XSS.This issue affects WPSHARE247 Elementor Addons: from n/a through = 2.5...