CVE-2025-49426 WordPress Kitring Theme <= 2.8 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Dahz Kitring kitring allows PHP Local File Inclusion.This issue affects Kitring: from n/a through = 2.8...

CVE-2025-49434

Deserialization of Untrusted Data vulnerability in WordPress Cars4Rent Theme/Cars4Rent plugin (CVE-2025-49434) affects Cars4Rent: from n/a through &lt;= 1.4.2. Root cause: PHP object deserialization leading to Object Injection. Impact is rated Critical (CVSS 3.1 base 9.8) with potential HIGH impa...

CVE-2025-49438 WordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3...

CVE-2025-48162 WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Business Directory Pro allows Reflected XSS. This issue affects Simple Business Directory Pro: from n/a through 15.5.1...

CVE-2025-53207

CVE-2025-53207 is a confirmed Local File Inclusion vulnerability in the WordPress plugin WP Travel Gutenberg Blocks (affected: versions up to 3.9.0). The root cause is improper control of the filename used in PHP include/require statements, enabling LFI and potentially local file exposure. CVSS v...

CVE-2025-54008

CVE-2025-54008 is a vulnerability in Crocoblock JetSmartFilters (JetSmartFilters) versions up to and including 3.6.7, identified as a Sensitive Information Exposure issue. The description notes an insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. Th...

CVE-2025-54044

CVE-2025-54044 is a reflected XSS vulnerability in WordPress Elite Video Player

CVE-2025-54677

CVE-2025-54677 concerns vcita’s Online Booking & Scheduling Calendar for WordPress (plugin: meeting-scheduler-by-vcita) up to version 4.5.3. The issue is an Unrestricted Upload of File with Dangerous Type , allowing attackers to upload malicious files. Public sources identify the affected plugin ...

CVE-2025-54750 WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a through = 3.11.1...

Tenda AC6 V5.0 HTTP Header Parsing denial of service vulnerability

Talos Vulnerability Report TALOS-2025-2166 Tenda AC6 V5.0 HTTP Header Parsing denial of service vulnerability August 20, 2025 CVE Number CVE-2025-30256 SUMMARY A denial of service vulnerability exists in the HTTP Header Parsing functionality of Tenda AC6 V5.0 V02.03.01.110. A specially crafted...

Linux Distros Unpatched Vulnerability : CVE-2020-2921

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are 8.0.19 and prior...

CVE-2025-8357 Media Library Assistant <= 3.27 - Authenticated (Author+) Limited File Deletion

The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path validation and user capability checking in the processmladownloadfile function in all versions up to, and including, 3.27. This makes it...

PT-2025-33749 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A flaw exists in the Linksys E5600 due to a risky cryptographic algorithm within the verify gemtek header function of the checkFw.sh file in the Firmware Handler component. The attack can be launche...

KLA86792 ACE vulnerability in Google Chrome

ACE vulnerability was found in Google Chrome. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories Stable Channel Update for Desktop Related products Google-Chrome CVE list CVE-2025-9132 critical Solution Update to the latest version Download Google Chrome...

WordPress ColorMag Theme <= 4.0.19 is vulnerable to Broken Access Control

Software ColorMag Type Theme Vulnerable versions = 4.0.19 Fixed in 4.0.20 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-9202 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 43bacb806b7e Credits Dmitrii Ignatyev Required privilege...

Linux Distros Unpatched Vulnerability : CVE-2025-29923

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when...

CVE-2025-4962

An Insecure Direct Object Reference IDOR vulnerability was identified in the POST /v1/templates endpoint of the Lunary API, affecting versions up to 0.8.8. This vulnerability allows authenticated users to create templates in another user's project by altering the projectId query parameter. The ro...

CVE-2025-8464

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9.0 via the wpcf7guestuserid cookie. This makes it possible for unauthenticated attackers to upload and delete files outside of the...

CVE-2017-20199

A vulnerability was found in Buttercup buttercup-browser-extension up to 0.14.2. Affected by this vulnerability is an unknown functionality of the component Vault Handler. The manipulation results in improper access controls. The attack may be performed from a remote location. A high complexity...

CVE-2025-32992

CVE-2025-32992 affects Thermo Fisher Scientific ePort up to version 3.0.0. The issue is an Incorrect Access Control vulnerability in the ePort component/file/feature (root cause not detailed in all sources) leading to a high-severity impact (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N; base sc...