CVE-2025-60111 WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through = 3.0.0.266...

CVE-2025-11005

The CVE-2025-11005 issue affects TOTOLINK X6000R, where OS Command Injection arises from improper neutralization of special elements in user input. Affected versions: X6000R up to and including V9.4.0cu.1458_B20250708. Root cause: failure to properly filter special elements allows an attacker to ...

CVE-2025-5494

ZohoCorp ManageEngine Endpoint Central is affected by an improper privilege management flaw in the agent setup. The issue impacts Endpoint Central versions up to 11.4.2500.25 and up to 11.4.2508.13. Root cause: improper privilege handling during the agent installation process, enabling local priv...

CVE-2025-9588

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.This issue affects enVision: before 250563...

CVE-2025-58270

Cross-Site Request Forgery CSRF vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request Forgery.This issue affects NIX Anti-Spam Light: from n/a through = 0.0.4...

PT-2025-39310

Name of the Vulnerable Software and Affected Versions TOTOLINK X6000R versions through V9.4.0cu.1360 B20241207 Description A flaw exists in TOTOLINK X6000R that allows for OS Command Injection. This occurs due to improper neutralization of special elements used in an OS command. An attacker could...

CVE-2025-9962

A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2025-53463

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows DOM-Based XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through =...

CVE-2025-59581

CVE-2025-59581 - Ibtana (WordPress Website Builder) Missing Authorization vulnerability present in Ibtana, allowing Arbitrary Content Deletion due to improper access control. Affected versions: up to 1.2.5.3 (from n/a to 1.2.5.3). Connected docs corroborate the issue as an access-control weakness...

CVE-2025-57964 WordPress Library Bookshelves Plugin <= 5.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in photonicgnostic Library Bookshelves library-bookshelves allows Stored XSS.This issue affects Library Bookshelves: from n/a through = 5.11...

CVE-2025-58677

Technical details about CVE-2025-58677 are not provided in the supplied documents. The Initial Description notes a CSRF-related Stored XSS affecting ShrinkTheWeb up to 2.8.5, but specific vectors, vulnerable components, affected files, or remediation steps are not disclosed here; monitor for upda...

CVE-2025-58678 WordPress Accordion Plugin <= 2.3.15 - Broken Access Control Vulnerability

Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through = 2.3.15...

PT-2025-38955

Name of the Vulnerable Software and Affected Versions Kommo Website Chat Button versions through 1.3.1 Description An authorization issue exists in the Kommo Website Chat Button integration, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update...

Exploit for CVE-2025-10035

CVE-2025-10035 How does this detection method work? Detec...

Security Bulletin: Sensitive Information Disclosure in IBM Lakehouse Through Stack Traces , affects watsonx.data

Summary IBM Lakehouse could potentially reveal sensitive information from stack traces that could be read by a local privileged user. This can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-36146 DESCRIPTION: IBM Lakehouse could potentially reveal sensitive information from stack trace...

PT-2025-38312

Name of the Vulnerable Software and Affected Versions ABB FLXEON versions through 9.3.5 Description An improper validation of specified type of input issue exists in ABB FLXEON. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability...

CVE-2025-8463

The CVE-2025-8463 entry maps to an authorization bypass in Nebula Informatics SecHard (SecHard) prior to version 3.6.2-20250805, caused by user-controlled key manipulation that bypasses authorization controls (parameter injection risk noted in PT-2025-38148). Affected component appears to be the ...

BIT-KYVERNO-2022-47633

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations a...

CVE-2025-48101

Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1...

PT-2025-37181

Name of the Vulnerable Software and Affected Versions: FoxCMS versions prior to 1.24 Description: A SQL injection issue exists in FoxCMS due to the manipulation of the ids argument within the batchCope function located in the /app/admin/controller/Images.php file. This allows for remote...