CVE-2025-22027 media: streamzap: fix race between device disconnection and urb callback

In the Linux kernel, the following vulnerability has been resolved: media: streamzap: fix race between device disconnection and urb callback Syzkaller has reported a general protection fault at function irraweventstorewithfilter. This crash is caused by a NULL pointer dereference of dev-raw...

CVE-2025-22025 nfsd: put dl_stid if fail to queue dl_recall

In the Linux kernel, the following vulnerability has been resolved: nfsd: put dlstid if fail to queue dlrecall Before calling nfsd4runcb to queue dlrecall to the callbackwq, we increment the reference count of dlstid. We expect that after the corresponding workstruct is processed, the reference...

CVE-2024-58094

In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before truncation in jfstruncatenolock Added a check for "read-only" mode in the jfstruncatenolock function to avoid errors related to writing to a read-only filesystem. Call stack: blockwritebegin...

CVE-2024-58095

In the Linux kernel, the following vulnerability has been resolved: jfs: add check read-only before txBeginAnon call Added a read-only check before calling txBeginAnon in extAlloc and extRecord. This prevents modification attempts on a read-only mounted filesystem, avoiding potential errors or...

WordPress Internal Link Optimiser plugin <= 5.1.3 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by johska in WordPress Plugin Internal Link Optimiser versions = 5.1.3...

WordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability

CSRF to RCE vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Custom CSS, JS & PHP versions = 2.4.1...

CVE-2025-22020

creationtimestamp| type| source ---|---|--- 2025-04-16 13:31:23+00:00| seen| https://t.me/cvedetector/23072 2025-06-16 16:20:28+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lrqf52eqqk2p...

CVE-2025-3692 SourceCodester Online Eyewear Shop Master.php cross site scripting

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /oews/classes/Master.php?f=saveproduct. The manipulation leads to cross site scripting. The attack can be launched...

CVE-2025-39592

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through = 1.3.0...

CVE-2025-39565

Deserialization of Untrusted Data vulnerability in Melapress MelaPress Login Security melapress-login-security allows Object Injection.This issue affects MelaPress Login Security: from n/a through = 2.1.0...

CVE-2025-39538

Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search wp-advanced-search allows Upload a Web Shell to a Web Server.This issue affects WP-Advanced-Search: from n/a through = 3.3.9.4...

CVE-2025-39520

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through = 2.2.0...

CVE-2025-39591

creationtimestamp| type| source ---|---|--- 2025-04-16 12:57:09+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12038 2025-04-16 14:43:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmwtcbzxtd2q 2025-04-16 16:02:57+00:00| seen| https://t.me/cvedetector/23100...

CVE-2025-39590

creationtimestamp| type| source ---|---|--- 2025-04-16 12:57:08+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12037 2025-04-16 14:43:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmwtcb7q6b2c 2025-04-16 16:03:08+00:00| seen| https://t.me/cvedetector/23103...

CVE-2025-39584

creationtimestamp| type| source ---|---|--- 2025-04-16 12:57:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12034 2025-04-16 14:43:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmwtccatlw2u 2025-04-16 16:02:55+00:00| seen|...

CVE-2025-39522

CVE-2025-39522 describes a Missing Authorization vulnerability in the WordPress plugin Dynamic Post , allow­ing an attacker to exploit an incorrectly configured access control to change settings. Affected software: Dynamic Post versions up to 4.10 (per the CVE description). Root cause: lack of pr...

CVE-2025-39525 WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel Slider: from n/a through = 2.1.3...

CVE-2025-39572

CVE-2025-39572 : Stored XSS in WordPress plugin “Checkout for PayPal” (Noor Alam) due to improper neutralization of input during web page generation. Affected versions: Checkout for PayPal from n/a through 1.0.38. Root cause: input handling flaw that allows arbitrary script injection into generat...

CVE-2025-39577

CVE-2025-39577 refers to a Stored XSS in the WordPress PropertyHive plugin (versions

CVE-2025-39579 WordPress Membership For WooCommerce plugin <= 2.8.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows DOM-Based XSS.This issue affects Membership For WooCommerce: from n/a through = 2.8.0...