AZL-60411 CVE-2025-32909 affecting package libsoup for versions less than 3.4.4-4

A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniffmp4 function. The HTTP server may cause the libsoup client to crash...

AZL-60393 CVE-2025-32909 affecting package libsoup for versions less than 3.0.4-7

A flaw was found in libsoup. SoupContentSniffer may be vulnerable to a NULL pointer dereference in the sniffmp4 function. The HTTP server may cause the libsoup client to crash...

CVE-2024-9230

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.9.18 does not sanitise and escape some of its settings when adding a podcast, which could allow author and above users to perform Stored Cross-Site Scripting attacks...

SoftCOM iKSORIS 跨站脚本漏洞

SoftCOM iKSORIS is an application from SoftCOM, Inc. A cross-site scripting vulnerability exists in SoftCOM iKSORIS versions prior to 79.0, which stems from a reflective cross-site scripting attack that could lead to malicious script execution...

CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3

CVE-2025-22870 affecting package prometheus-node-exporter for versions less than 1.7.0-3. A patched version of the package is available...

AZL-59888 CVE-2025-32728 affecting package openssh for versions less than 9.8p1-4

In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding...

📄 WordPress Buddypress Humanity 1.2 Cross Site Request Forgery

WordPress Buddypress Humanity plugin versions 1.2 and below suffer from a cross site request forgery vulnerability. ⚠️ CVE-2025-31033 - CSRF in WordPress Buddypress Humanity Plugin...

AZL-59979 CVE-2025-32387 affecting package cert-manager for versions less than 1.12.15-4

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3...

CVE-2025-31020

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XSS.This issue affects Simple Spoiler: from n/a through = 1.4...

Drupal Gif Player Field module < 1.5.0,2.0.0-2.0.3 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Gif Player Field versions 1.5.0,2.0.0-2.0.3...

Drupal ECA: Event - Condition - Action module < 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Drupal ECA: Event - Condition - Action module 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2 - Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Juraj Nemec poker10 in WordPress Module ECA: Event - Condition - Action versions 1.1.12,2.0.0-2.0.15,2.1.0-2.1.6,1.2...

Drupal WEB-T module < 1.1.0 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Jan Kellermann jan kellermann in WordPress Module WEB-T versions 1.1.0...

Drupal Panels module < 4.9.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Manuel Adán manuel.adan in WordPress Module Panels versions 4.9.0...

AZL-59656 CVE-2025-22871 affecting package golang for versions less than 1.18.8-7

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext...

AZL-59772 CVE-2025-22014 affecting package kernel for versions less than 5.15.180.1-1

In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: Fix the potential deadlock When some client process A call pdraddlookup to add the look up for the service and does schedule locator work, later a process B got a new server packet indicating locator is up and cal...

AZL-59722 CVE-2025-32414 affecting package libxml2 for versions less than 2.10.4-7

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters...

AZL-59745 CVE-2025-29481 affecting package bcc for versions less than 0.29.1-3

Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpfobjectinitprog function of libbpf. This has been disputed by third parties who assert that "no one in their sane mind should be passing untrusted ELF files into libbpf while running under...

AZL-59530 CVE-2025-32052 affecting package libsoup for versions less than 3.0.4-6

A flaw was found in libsoup. A vulnerability in the sniffunknown function may lead to heap buffer over-read...

AZL-59547 CVE-2025-32050 affecting package libsoup for versions less than 3.4.4-6

A flaw was found in libsoup. The libsoup appendparamquoted function may contain an overflow bug resulting in a buffer under-read...

SUSE CVE-2025-3034

Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137 and Thunderbird 137...