PT-2025-3284 · Unknown · Connectivity Module

Name of the Vulnerable Software and Affected Versions: Connectivity module affected versions not specified Description: The issue is related to a permission control vulnerability in the Connectivity module. Successful exploitation of this vulnerability may cause features to perform abnormally...

PT-2025-1900 · WordPress · The 140+ Widgets | Xpro Addons For Elementor

Name of the Vulnerable Software and Affected Versions: 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.6.2 Description: The issue allows authenticated attackers, with Contributor-level access and above, to extract potentially sensitive data...

SUSE CVE-2024-56761

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH CPs An indirect branch instruction sets the CPU indirect branch tracker IBT into WAITFORENDBRANCH WFE state and WFE stays asserted across the instruction boundary. When the decoder finds a...

PT-2025-1635

Name of the Vulnerable Software and Affected Versions Member Access plugin for WordPress versions up to, and including, 1.1.6 Description The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as administrators, through the WordPress...

PT-2025-1634

Name of the Vulnerable Software and Affected Versions The Passster – Password Protect Pages and Content plugin for WordPress versions up to, and including, 4.2.10 Description The issue allows unauthenticated attackers to extract sensitive data from posts restricted to higher-level roles, such as...

CVE-2024-11282: Exposure of Sensitive Information to an Unauthorized Actor

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.10 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that...

PT-2025-1845 · WordPress · Compare Products For Woocommerce

Name of the Vulnerable Software and Affected Versions: Compare Products for WooCommerce plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Reflected Cross-Site Scripting via the s feature parameter due to insufficient input sanitization and output...

PT-2025-1780 · WordPress · Toggles Shortcode/Widget

Name of the Vulnerable Software and Affected Versions: Toggles Shortcode and Widget plugin for WordPress versions up to, and including, 1.14 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping through the content parameter...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security vulnerability previously existed in Mozilla Firefox version 134, which stemmed from the fact that under certain circumstances, the user opt-in setting of Focus, which requires authentication...

CVE-2024-11290: Exposure of Sensitive Information to an Unauthorized Actor

The Member Access plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.6 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to...

PT-2025-3810

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 134 Description A user opt-in setting that requires authentication before using Focus could be bypassed under certain circumstances. Recommendations For versions prior to 134, update to a version that includes the fix...

Security Updates for Microsoft Word Products C2R (November 2024)

The Microsoft Word Products are missing a security update. It is, therefore, affected by a security feature bypass vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc...

Privacy of Photos.app’s Enhanced Visual Search

Initial speculation about a new Apple feature...

Fixed in ClickHouse v25.1.5.5, 2025-01-05​

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

GoCD code issues and vulnerabilities

GoCD is a continuous delivery server for GoCD open source. A code issue vulnerability exists in GoCD versions 16.7.0 through 24.4.0 that stems from an XML External Entity XXE injection vulnerability that allows abuse of the hidden/unused Configuration Repository feature...

org.jboss.narayana.rts:lra-test-arquillian-extension (6.0.0.final), org.wildfly:wildfly-galleon-pack (>=28.0.0.beta1, <=28.0.1.final) +3 more potentially affected by CVE-2024-8447 via org.jboss.narayana.rts:lra-coordinator-jar (6.0.0.final)

org.jboss.narayana.rts:lra-coordinator-jar MAVEN version 6.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss.narayana.rts:lra-coordinator-jar and may be impacted: - org.jboss.narayana.rts:lra-test-arquillian-extension 6.0.0.final -...

PT-2026-3641

Name of the Vulnerable Software and Affected Versions PLY Python Lex-Yacc version 3.11 Description An undocumented and unsafe feature in the PLY library allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with...

PT-2025-36276

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 923f3a2b48bd Description A division by zero fault can occur during the early booting stage on machines with X86 FEATURE CQM supported. This is due to get rdt mon resources attempting to calculate mon l3 config wi...

PT-2024-36763 · Woocommerce · Wishlist For Woocommerce: Multi Wishlists Per Customer

Name of the Vulnerable Software and Affected Versions: Wishlist for WooCommerce: Multi Wishlists Per Customer versions prior to 3.1.2 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-site Scripting XSS. Specifically, it enabl...

CVE-2024-56643

In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccpfeatchangerecv If dccpfeatpushconfirm fails after new value for SP feature was accepted without reconciliation 'entry == NULL' branch, memory allocated for that value with dccpfeatclonespval is never...