Amazon Corretto Java 17.x < 17.0.17.10.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 17 prior to 17.0.17.10.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-17-2025-Oct-21 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition...

HCL AION Information Disclosure Vulnerability (CNVD-2026-16412)

HCL AION is an AI lifecycle management platform from HCL India. HCL AION suffers from an information disclosure vulnerability that can be exploited by an attacker to gain access to cached data information...

WordPress plugin WPC Smart Wishlist for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-42690

Name of the Vulnerable Software and Affected Versions WPC Smart Wishlist for WooCommerce plugin for WordPress versions through 5.0.4 Description The WPC Smart Wishlist for WooCommerce plugin for WordPress is susceptible to unauthorized data access. A missing capability check on the wishlist...

Adobe Commerce Security Bypass Vulnerability (CNVD-2025-24198)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A security bypass vulnerability exists in Adobe Commerce, which could be exploited by an attacker to bypass security measures and gain unauthorized read...

CVE-2025-41020 Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito

Insecure direct object reference IDOR vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticketa4.php'...

VulnCheck KEV: CVE-2025-27223

TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints such as /trufusionPortal/getProjectList. However, the application uses a static key to create the encrypted cookie, ultimately allowing anyone to forge cookies and gain access to...

WSO2 Enterprise Integrator 安全漏洞

WSO2 Enterprise Integrator is an open source hybrid integration platform from WSO2, Inc. in the United States. The platform supports communication between multiple applications. A security vulnerability exists in WSO2 Enterprise Integrator that stems from insufficient privilege restrictions in th...

PT-2025-42435

Name of the Vulnerable Software and Affected Versions Sergestec Exito version 8.0 Description An insecure direct object reference IDOR issue exists in Sergestec Exito version 8.0. This allows an attacker to access data belonging to other customers. The issue is present in the /admin/ticket a4.php...

CVE-2025-53860

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module HSM information on F5 rSeries systems. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-11501

The Dynamically Display Posts plugin for WordPress is vulnerable to SQL Injection via the 'taxquery' parameter in all versions up to, and including, 1.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2025-31702

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may...

CVE-2025-31702

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may...

EUVD-2025-34517

A vulnerability exists in certain Dahua embedded products. Third-party malicious attacker with obtained normal user credentials could exploit the vulnerability to access certain data which are restricted to admin privileges, such as system-sensitive files through specific HTTP request. This may...

PT-2025-42234

Name of the Vulnerable Software and Affected Versions Dahua embedded products affected versions not specified Description An improper permission assignment for a critical resource allows a remote attacker with normal user credentials to access data restricted to administrator privileges via a...

CVE-2025-11701: Missing Authorization

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the zacreatezipcallback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to...

PT-2025-42367

Name of the Vulnerable Software and Affected Versions F5OS-A affected versions not specified Description A vulnerability allows a highly privileged, authenticated attacker to access sensitive FIPS hardware security module HSM information on F5 rSeries systems. Recommendations At the moment, there...

PT-2025-42311

Name of the Vulnerable Software and Affected Versions WordPress Zip Attachments plugin versions up to and including 1.6 Description The Zip Attachments plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check and a lack of post status...

CVE-2025-10648: Missing Authorization

The YourMembership Single Sign On – YM SSO Login plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'moymdisplaytestattributes' function in all versions up to, and including, 1.1.7. This makes it possible for unauthenticated attackers to rea...

The vulnerability of the Ivanti Endpoint Manager software management tool lies in the lack of security measures for the SQL query structure, allowing attackers to read arbitrary data.

The vulnerability of the Ivanti Endpoint Manager software management tool is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to read arbitrary data remotely...