CVE-2025-9854: Improper Neutralization of Input During Web Page Generation

The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible f...

CVE-2025-34226: Improper Control of a Resource Through its Lifetime

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

SUSE-SU-2025:03450-1 Security update for cairo

This update for cairo fixes the following issues: - CVE-2019-6461: Avoid assert when drawing arcs with NaN angles. bsc1122338 - CVE-2025-50422: Fix NULL pointer access in activeedgestotraps leading to crash in Poppler. bsc1247589...

Operation Cronos and the Takedown of LockBit: A Cybersecurity Milestone

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Introduction LockBit aka ABCD Ransomware, one of the most destructive ransomware groups in history, was dismantled in early 2024 through a...

CVE-2025-58769: Improper Limitation of a Pathname to a Restricted Directory

auth0-PHP is an SDK for Auth0 Authentication and Management APIs. In versions 3.3.0 through 8.16.0, the Bulk User Import endpoint in applications built with the SDK does not validate the file-path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths o...

CVE-2025-34224

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to version 22.0.1049 and Application prior to version 20.0.2786 VA/SaaS deployments expose a set of PHP scripts under the consolerelease directory without requiring authentication. An unauthenticated remote attacker can invoke these...

Advisory ROSA-SA-2025-3029

software: redis 7.2.10 OS: ROSA-CHROME unaffected versions = redis-7.2.10-1 affected versions redis-7.2.10-1 CVE-ID: CVE-2024-31227 BDU-ID: 2024-09249 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability exists in the Redis database management system due to insufficient input validation. Exploitation of t...

PT-2025-39580

Name of the Vulnerable Software and Affected Versions Galaxy Weblinks Post Featured Video versions through 1.7 Description A Cross-Site Request Forgery issue exists in Galaxy Weblinks Post Featured Video. This allows for Cross Site Request Forgery attacks. Recommendations At the moment, there is ...

CVE-2025-60094: Missing Authorization

Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through = 3.18.1...

CVE-2025-58969

Missing Authorization vulnerability in Greg Winiarski Custom Login URL custom-login-url allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Login URL: from n/a through = 1.0.2...

UNC5221 Uses BRICKSTORM Backdoor to Infiltrate U.S. Legal and Technology Sectors

Companies in the legal services, software-as-a-service SaaS providers, Business Process Outsourcers BPOs, and technology sectors in the U.S. have been targeted by a suspected China-nexus cyber espionage group to deliver a known backdoor referred to as BRICKSTORM. The activity, attributed to UNC52...

USN-7770-1 linux-azure vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACP...

CVE-2025-4993

Untrusted Pointer Dereference vulnerability in RTI Connext Professional Core Libraries allows Pointer Manipulation.This issue affects Connext Professional: from 7.4.0 before 7.6.0, from 7.0.0 before 7.3.0.10, from 6.1.0 before 6.1.2.27, from 6.0.0 before 6.0., from 5.3.0 before 5.3., from 4.4a...

CVE-2025-9962

CVE-2025-9962 describes an unauthenticated buffer overflow in the Novakon P series (P – V2001.A.C518o2) that allows root privileges to be gained without authentication. The current connected documents do not indicate a remediation patch or version containing a fix; one source notes there is no in...

WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Request a Quote versions = 2.5.0...

CVE-2025-58915: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through = 2.5.0...

CVE-2025-58688

Cross-Site Request Forgery CSRF vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through = 2.1.4...

CVE-2025-58675

CVE-2025-58675 : CSRF vulnerability in Interact: Embed A Quiz On Your Site. Affected software: Interact: Embed A Quiz On Your Site (from n/a through 3.1). From the description, the weakness is Cross-Site Request Forgery with network attack vector, low likelihood requirements, and user interaction...

CVE-2025-58675: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in tryinteract Interact: Embed A Quiz On Your Site interact-quiz-embed allows Cross Site Request Forgery.This issue affects Interact: Embed A Quiz On Your Site: from n/a through = 3.1...

PT-2025-38963

Name of the Vulnerable Software and Affected Versions Interact: Embed A Quiz On Your Site versions through 3.1 Description A Cross-Site Request Forgery CSRF issue exists in Interact: Embed A Quiz On Your Site. This allows attackers to perform actions on behalf of an unsuspecting user...