113821 matches found
CVE-2025-0655
CVE-2025-0655 is a duplicate of CVE-2024-55890. Connected sources describe a D-Tale (dtale) RCE affecting dtale versions around 3.15.1 where an attacker can override global state to enable enable_custom_filters, then abuse the /test-filter endpoint to execute arbitrary commands, with the fix in 3...
CVE-2024-10109
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
CVE-2025-1314 Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctfclearcacheadmin function. This makes it possible for...
CVE-2025-1314
CVE-2025-1314 (Custom Twitter Feeds – A Tweets Widget or X Feed Widget for WordPress) is a CSRF vulnerability present in all versions up to and including 2.2.5. The root cause is missing or incorrect nonce validation in the ctf_clear_cache_admin() function, enabling unauthenticated attackers to r...
CVE-2025-1314 Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctfclearcacheadmin function. This makes it possible for...
Ollama security vulnerabilities
Ollama is an Ollama open source large-scale language model that can be started and run locally. A security vulnerability exists in Ollama version 0.3.14 and earlier, which stems from the fact that uploading a custom GGUF model file may cause the server to allocate unlimited memory, leading to a...
phpIPAM Cross-Site Script Vulnerability
phpIPAM is the phpIPAM open source set of open source PHP and MySQL based IP address management applications IPAM. A cross-site scripting vulnerability exists in phpIPAM version 1.5.2, which stems from a stored cross-site scripting vulnerability in the Description field of the custom field in the...
WordPress plugin Custom Twitter Feeds: Cross-site Request Forgery Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
H2O Vulnerable to Execution of Arbitrary Files
In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacke...
CVE-2025-1314: Cross-Site Request Forgery (CSRF)
The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.5. This is due to missing or incorrect nonce validation on the ctfclearcacheadmin function. This makes it possible for...
CVE-2024-10109: Incorrect Authorization
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
PT-2025-12003
Name of the Vulnerable Software and Affected Versions Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress versions up to, and including, 2.2.5 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ctf clear cach...
PT-2025-12025
Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to the commit that fixes the issue affected versions not specified Description A vulnerability allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access...
WordPress Custom Twitter Feeds plugin <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function vulnerability
Cross-Site Request Forgery to Cache Reset via ctfclearcacheadmin Function vulnerability discovered by Kévin Mosbahi Mika in WordPress Plugin Custom Twitter Feeds Tweets Widget versions = 2.2.5...
DRUPAL-CORE-2025-004
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...
WordPress custom-post-edit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin custom-post-edit versions = 1.0.4...
Amazon Linux AMI : emacs (ALAS-2025-1964)
The version of emacs installed on the remote host is prior to 24.3-20.26. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1964 advisory. A flaw was found in the Emacs text editor. Improper handling of custom man URI schemes allows attackers to execute arbitrary shell...
PT-2025-11597
Name of the Vulnerable Software and Affected Versions Easy Custom Admin Bar plugin for WordPress version 1.0 and earlier Description The issue is related to Reflected Cross-Site Scripting via the msg parameter due to insufficient input sanitization and output escaping. This allows unauthenticated...
CVE-2025-29781 Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD
The Bare Metal Operator BMO implements a Kubernetes API for managing bare metal hosts in Metal3. Baremetal Operator enables users to load Secret from arbitrary namespaces upon deployment of the namespace scoped Custom Resource BMCEventSubscription. Prior to versions 0.8.1 and 0.9.1, an adversary...
