CVE-2026-22611

The CVE-2026-22611 issue affects the AWS SDK for .NET (versions 4.0.0 through 4.0.3.2) where the region input field could be set to an invalid value, causing AWS API calls to be routed to non-existent or non‑AWS hosts. A defense‑in‑depth enhancement was added in v4, validating that the region for...

CVE-2022-42149

kkFileView 4.0 is vulnerable to Server-side request forgery SSRF via controller\OnlinePreviewController.java...

CVE-2023-4158

Cross-site Scripting XSS - Stored in GitHub repository omeka/omeka-s prior to 4.0.3...

CVE-2025-14436 Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting

The Brevo for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘userconnectionid’ parameter in all versions up to, and including, 4.0.49 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Selea CarPlateServer 访问控制错误漏洞

Selea CarPlateServer is a car plate recognition software from Selea, Italy. An access control error vulnerability exists in Selea CarPlateServer version 4.0.1.6, which originates from the ability to bypass authentication by manipulating the NOLISTEXEPATH configuration parameter, which could lead ...

CVE-2025-68951

CVE-2025-68951 affects phpMyFAQ. Versions 4.0.14 and 4.0.15 contain a stored XSS vulnerability where an attacker’s HTML entities in a display_name are decoded server-side and rendered unescaped in the admin user list (Twig |raw), enabling script execution in an administrator’s context. A patch ex...

PT-2025-53692

Name of the Vulnerable Software and Affected Versions Gmission Web Fax versions 3.0 through 3.9 Description An improper authentication issue exists in Gmission Web Fax that can lead to privilege escalation. The issue affects the application’s authentication mechanisms, potentially allowing...

CVE-2025-15135 joey-zhou xiaozhi-esp32-server-java Cookie AuthenticationInterceptor.java tryAuthenticateWithCookies improper authentication

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper authentication. The attack can be launche...

WordPress plugin WP Adminify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-51885

Name of the Vulnerable Software and Affected Versions Amazon S3 Encryption Client for Go versions prior to 4.0 Description A missing cryptographic key commitment in the Amazon S3 Encryption Client for Go could allow a user with write access to an S3 bucket to introduce a new EDK Encrypted Data Ke...

PT-2025-51421

Name of the Vulnerable Software and Affected Versions WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions through 4.0.7 Description An authorization issue exists in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent. The issue involves incorrectly configured...

CVE-2025-13148

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password...

CVE-2025-13211 IBM Aspera Orchestrator Denial of Service

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency...

EUVD-2025-202076

Missing Authorization vulnerability in GSheetConnector by WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through = 4.0.0...

PT-2025-50115

Name of the Vulnerable Software and Affected Versions Fortinet FortiSandbox versions 4.0 all versions Fortinet FortiSandbox versions 4.2 all versions Fortinet FortiSandbox versions 4.4.0 through 4.4.7 Fortinet FortiSandbox versions 5.0.0 through 5.0.2 Description An Improper Neutralization of Inp...

CVE-2025-65230

Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting XSS vulnerability in the Web UI Configuration Streaming Destination input...

Important Photon OS Security Update - PHSA-2025-4.0-0919

Updates of 'linux' packages of Photon OS have been released...

CVE-2025-60633

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the NudmSubscriberDataManagement API...

Slackware Linux 15.0 / current xpdf Multiple Vulnerabilities (SSA:2025-319-01)

The version of xpdf installed on the remote host is prior to 4.06. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2025-319-01 advisory. New xpdf packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

CVE-2025-13186 Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting

A weakness has been identified in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution up to 4.0. This impacts an unknown function of the file /dashboard/Ccustomer/managecustomer. This manipulation of the argument Search causes cross site scripting. The attack may be initiated...