CVE-2025-58669 WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

Penetration-Testing---Metasploitable-2

Penetration Testing — Metasploitable 2 Lab Autore: Adriano Tum...

CVE-2025-57396

Tandoor Recipes 2.0.0-alpha-1, fixed in 2.0.0-alpha-2, is vulnerable to privilege escalation. This is due to the rework of the API, which resulted in the User Profile API Endpoint containing two boolean values indicating whether a user is staff or administrative. Consequently, any user can escala...

CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2

CVE-2024-33394 affecting package kubevirt for versions less than 1.5.0-2. An upgraded version of the package is available that resolves this issue...

CVE-2025-54409 affecting package aide for versions less than 0.18.6-2

CVE-2025-54409 affecting package aide for versions less than 0.18.6-2. A patched version of the package is available...

CVE-2025-40908 affecting package perl-YAML-LibYAML for versions less than 0.902.0-2

CVE-2025-40908 affecting package perl-YAML-LibYAML for versions less than 0.902.0-2. An upgraded version of the package is available that resolves this issue...

Linux Distros Unpatched Vulnerability : CVE-2023-53322

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminaterportio to exit before making sure all IOs...

Medium: redis

Issue Overview: TOCTOU in linenoiseHistorySave in linenoise allows local attackers to overwrite arbitrary files and change permissions via a symlink race between fopen"w" on the history path and subsequent chmod on the same path. CVE-2025-9810 Affected Packages: redis Note: This advisory is...

Amazon Linux 2 : pki-core, --advisory ALAS2-2025-2995 (ALAS-2025-2995)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2995 advisory. Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows Cross-Site Scripting XSS.This issue affects Bootstrap: from 3.4.1 before 4.0.0...

Amazon Linux 2 : udisks2, --advisory ALAS2-2025-2992 (ALAS-2025-2992)

The version of udisks2 installed on the remote host is prior to 2.7.3-9. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2992 advisory. A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is...

Important: ImageMagick

Issue Overview: ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in...

PT-2025-37912

Name of the Vulnerable Software and Affected Versions: Ubit Information Technologies STOYS versions 2 through 20250916 Description: The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows for Cross-Site Scripting XSS. The vendor has not yet...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2025-042 (ALASFIREFOX-2025-042)

The version of firefox installed on the remote host is prior to 140.2.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2FIREFOX-2025-042 advisory. Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo:...

CVE-2025-59145 [email protected] contains malware after npm account takeover

color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect cryptocurrenc...

CVE-2025-59142

CVE-2025-59142 affects the color-string library (JavaScript) with a malware payload injected in version 2.1.1 after an npm account take-over. The payload targets browser contexts to attempt redirection of cryptocurrency transactions (e.g., to attacker wallets) when the package is used in web envi...

Security update for the Linux Kernel (Live Patch 2 for SLE 15 SP7)

This update for the Linux Kernel 6.4.0-150700536 fixes several issues. The following security issue was fixed: CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU bsc1246030. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

AZL-67328 CVE-2025-59375 affecting package expat for versions less than 2.6.4-2

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing...

AZL-67359 CVE-2025-59375 affecting package expat for versions less than 2.6.4-2

libexpat in Expat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing...

CVE-2025-27233

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system...

DEBIAN-CVE-2025-27234

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution...