GHSA-84HF-8GH5-575J Kirby CMS has cross-site scripting (XSS) in the changes dialog

TL;DR This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. ---- Introductio...

SUSE-RU-2025:21046-1 Recommended update for afterburn

This update for afterburn fixes the following issues: - Update to version 5.9.0.git21.a73f509: docs/release-notes: update for release 5.10.0 cargo: update dependencies microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat docs/release-notes: Add entry for Azure SharedConfig XML...

EUVD-2025-197934

The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage function. This makes it possible for unauthenticated attackers to update setting...

CVE-2025-12827 Top Friends <= 0.3 - Cross-Site Request Forgery to Settings Update

The Top Friends plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.3. This is due to missing nonce validation on the topfriendsoptionssubpanel function. This makes it possible for unauthenticated attackers to modify plugin settings via a forge...

EUVD-2025-197957

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type...

PT-2025-47298

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A SQL injection issue exists in WinPlus version 24.11.27. This allows an attacker to recover, create, update, and delete databases. The issue is triggered by sending a POST request to the...

WordPress plugin Download Panel 安全漏洞

WordPress Download Panel plugin is a tool for managing, tracking and controlling WordPress website file downloads, supports custom post types, drag-and-drop uploads, access control, etc. It allows you to set download speed, password protection and IP blocking, and provides rich download templates...

WordPress plugin Broken Link Checker by AIOSEO 安全漏洞

WordPress Broken Link Checker by AIOSEO plugin is a tool for detecting and repairing internal and external links on your website, supporting SEO optimization and website maintenance. WordPress Broken Link Checker by AIOSEO plugin suffers from a missing authorization vulnerability, which can be...

WordPress plugin Restrictions for BuddyPress 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A security...

CVE-2025-12849

The Contest Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 28.0.2. This is due to the plugin registering the cgcheckwpadminuploadv10 AJAX action for both authenticated and unauthenticated users without implementing capability checks or non...

SUSE SLED15: binutils / binutils-devel / binutils-devel-32bit / etc (SUSE-SU-2025:4096-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4096-1 advisory. - Do not enable '-z gcs=implicit' on aarch64 for old codestreams. Update to version 2.45: New...

WordPress plugin Qi Blocks 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An Access...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

EUVD-2025-197620

Flowise Fails to Invalidate Existing Sessions After Password Changes...

Vulnerabilities fixed in Cisco Catalyst Center

Cisco has fixed vulnerabilities in Cisco Catalyst Center. This vulnerability with reference CVE-2025-20341, arises from insufficient validation of user input. A malicious party could exploit this, by sending a specially crafted HTTP request, enabling unauthorized system changes, such as creating...

EUVD-2025-177187

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

CVE-2025-12377 Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-leve...

EUVD-2025-169287

The Gallery Plugin for WordPress – Envira Photo Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several functions in all versions up to, and including, 1.12.0. This makes it possible for authenticated attackers, with Author-leve...

Malicious code in webdriver-manager-ethology-kastra-biotechnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4d50f3fa880cc105429f154e2bc09e5b09429538db303307688c9609ca30e2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-equinox-build-nova (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936f198e0e70f653d369a2d4c68b7759255a33a0397ab6045251c30465cc7e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...