CVE-2025-8568: Improper Neutralization of Input During Web Page Generation

The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-8621: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-8685: Improper Neutralization of Input During Web Page Generation

The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

PT-2025-32620 · WordPress · Wp Chart Generator

Name of the Vulnerable Software and Affected Versions: Wp chart generator versions up to and including 1.0.4 Description: The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting through the plugin’s wpchart shortcode due to insufficient input sanitization and outp...

PT-2025-32618 · WordPress · Gmap Generator

Name of the Vulnerable Software and Affected Versions: GMap Generator plugin for WordPress versions up to and including 1.1 Description: The GMap Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the h parameter. Insufficient input sanitization and output escapi...

PT-2025-32619 · WordPress · Mosaic Generator

Name of the Vulnerable Software and Affected Versions: Mosaic Generator plugin for WordPress versions up to and including 1.0.5 Description: The Mosaic Generator plugin for WordPress is susceptible to Stored Cross-Site Scripting through the c parameter due to insufficient input sanitization and...

IAG: Input-Aware Backdoor Attack on VLMs for Visual Grounding

Vision-language models VLMs have shown significant advancements in tasks such as visual grounding, where they localize specific objects in images based on natural language queries and images. However, security issues in visual grounding tasks for VLMs remain underexplored, especially in the conte...

WordPress Mosaic Generator plugin <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'c' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Mosaic Generator versions = 1.0.5...

WordPress Wp chart generator plugin <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wpchart Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Wp chart generator versions = 1.0.4...

WordPress GMap - Venturit plugin <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter vulnerability

WordPress GMap - Venturit plugin = 1.1 - Authenticated Contributor+ Stored Cross-Site Scripting via 'h' Parameter vulnerability discovered by muhammad yudha in WordPress Plugin GMap Generator versions = 1.1...

firefox: thunderbird: Incorrect JavaScript state machine for generators

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The JavaScript engine did not handle closed generators correctly, and it was possible to resume them, resulting in a nullptr dereference...

firefox: thunderbird: Incorrect JavaScript state machine for generators

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The JavaScript engine did not handle closed generators correctly, and it was possible to resume them, resulting in a nullptr dereference...

BIT-LIBPHP-2023-3247 Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP

In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, 8.2. before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for failure, and was using narrower range of values than it should have. In case of random generator failure, it could lead to a disclosure ...

Linux Distros Unpatched Vulnerability : CVE-2025-21925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llc: do not use skbget before devqueuexmit syzbot is able to crash hosts 1, using llc and devices not supporting IFFTXSKBSHARING. In this case, e1000 driver cal...

Linux Distros Unpatched Vulnerability : CVE-2023-52753

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amd/display: Avoid NULL dereference of timing generator Why & How Check whether assigned timing generator is NULL or not before accessing its funcs to preve...

Linux Distros Unpatched Vulnerability : CVE-2017-15116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The rngapireset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service NULL pointer dereference. CVE-2017-15116...

UBUNTU-CVE-2025-8733

A flaw has been found in GNU Bison up to 3.8.2. This affects the function obstackvprintfinternal of the file obprintf.c. Executing manipulation can lead to reachable assertion. The attack requires local access. The exploit has been published and may be used. It is still unclear if this...

Number withdrawal

GNU Bison is a programming language parser generator for the US GNU community. This CVE number has been withdrawn...

Number withdrawal

GNU Bison is a programming language parser generator for the US GNU community. This CVE number has been withdrawn...

Linux Distros Unpatched Vulnerability : CVE-2024-45157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Mbed TLS before 2.28.9 and 3.x before 3.6.1, in which the user-selected algorithm is not used. Unlike previously documented, enabling...