CVE-2025-50270

A stored Cross Site Scripting xss vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters...

Files security vulnerabilities

Files is a single-file PHP application from the individual developer Karl Ward. It can be dragged and dropped into any directory, allowing browsing of the files and directories within. A security vulnerability exists in Files 0.16.9 and earlier versions, which stems from the file moving feature n...

GHSA-QGJ7-FMQ2-6CC4 Hashicorp Vault has Lockout Feature Authentication Bypass

Vault and Vault Enterprise’s “Vault” user lockout feature could be bypassed for Userpass and LDAP authentication methods. Fixed in Vault Community Edition 1.20.1 and Vault Enterprise 1.20.1, 1.19.7, 1.18.12, and 1.16.23...

OpenAI kills “short-lived experiment” where ChatGPT chats could be found on Google

A little-known ChatGPT "feature" is now gone. It could be a good thing. On X, OpenAI Chief Information Security Officer Dane Stuckey announced that OpenAI "removed a feature from ChatGPT that allowed users to make their conversations discoverable by search engines, such as Google." Stuckey called...

CVE-2025-7725: Improper Neutralization of Input During Web Page Generation

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment feature in all versions up to, and including, 26.1.0 due to...

GLPI Cross-Site Scripting Vulnerability (CNVD-2025-17793)

GLPI is a free asset and IT management software suite. A phishing attack vulnerability exists in GLPI versions 9.1.0 through 10.0.18, which stems from a planning feature that does not effectively filter malicious links sent by unauthenticated users. An attacker could use this vulnerability to...

MAL-2025-6420 Malicious code in frontend-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in frontend-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-46359

A path traversal issue exists in backup and restore feature of multiple versions of PowerCMS. A product administrator may execute arbitrary code by restoring a crafted backup file...

Devolutions Server <= 2025.2.4.0 UI Discrepancy for Security Feature (DEVO-2025-0013) (CVE-2025-8353)

The version of Devolutions Server installed on the remote host is prior or equal to 2025.2.4.0 and is, therefore, affected by a UI discrepancy for security feature vulnerability: - UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0...

CVE-2025-8312

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following versions : Devolutions Server 2025.2.2.0 through 2025.2.5.0...

CVE-2025-8312

A deadlock vulnerability exists in the PAM automatic check-in feature of Devolutions Server . The issue is caused by a deadlock in the scheduling service , which allows a password to remain valid beyond its intended check-out period. This vulnerability affects Devolutions Server versions 2025.2.2...

CVE-2025-8312

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following versions : Devolutions Server 2025.2.2.0 through 2025.2.5.0...

UBUNTU-CVE-2025-52897

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

CVE-2025-52897 GLPI is vulnerable to XSS and open redirection attacks through planning feature

GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19...

GHSA-6V2P-P543-PHR9 vulnerabilities

Vulnerabilities for packages: tfsec, cert-exporter, cosign, prometheus-pushgateway, terraform-provider-pagerduty, cloudprober-fips, istio-pilot-discovery, thanos-fips, fulcio-fips, redis-operator, dynamic-localpv-provisioner-fips, atlantis, neuvector-sigstore-interface-fips, temporal-server,...

org.keycloak:keycloak-authz-policy-drools (3.2.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.2.0.cr1) +6 more potentially affected by CVE-2025-7365 via org.keycloak:keycloak-services (3.2.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.0.cr1 -...

org.keycloak:keycloak-authz-policy-drools (3.4.1.final), org.keycloak:keycloak-dependencies-server-all (3.4.1.final) +6 more potentially affected by CVE-2025-7365 via org.keycloak:keycloak-services (3.4.1.final)

org.keycloak:keycloak-services MAVEN version 3.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.1.final -...