CVE-2025-26747 WordPress RainbowNews theme <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue affects RainbowNews: from n/a through 1.0.7...

CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Contact Form III allows Reflected XSS. This issue affects WP Contact Form III: from n/a through 1.6.2d...

CVE-2024-13801 BWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

The BWL Advanced FAQ Manager plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'bafsetnoticestatus' AJAX action in all versions up to, and including, 2.1.4. This makes it possible for authenticated...

CVE-2025-26010

Telesquare TLR-2005KSH 1.1.4 allows unauthorized password modification when requesting the admin.cgi parameter with setUserNamePassword...

CVE-2025-27830

creationtimestamp| type| source ---|---|--- 2025-03-25 23:40:39+00:00| seen| https://t.me/cvedetector/21125 2025-03-26 01:04:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llalpbbiml26...

CVE-2025-30222

Shescape vulnerability (CVE-2025-30222) affects versions 1.7.2–2.1.1 of the JavaScript shell-escape library. On Windows, when shell: 'cmd.exe' or shell: true is configured and any of quote/quoteAll/escape/escapeAll is used, an attacker may gain read-only access to environment variables due to env...

CVE-2025-27832

An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpdl.c...

CVE-2024-55030

creationtimestamp| type| source ---|---|--- 2025-03-25 20:24:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8750 2025-03-25 23:40:51+00:00| seen| https://t.me/cvedetector/21133 2025-03-26 01:05:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llalqwzwx...

CVE-2024-31896

creationtimestamp| type| source ---|---|--- 2025-03-25 19:24:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8735 2025-03-25 21:04:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lla6dgfnem26 2025-03-25 22:00:06+00:00| seen| https://t.me/cvedetector/21114...

CVE-2025-30567

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through = 2.6.2...

CVE-2025-24514

A flaw was found in ingress-nginx https://github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This issue can lead to arbitrary code execution in the context of the ingress-nginx controller and disclosure of Secrets accessible t...

CVE-2025-2635

creationtimestamp| type| source ---|---|--- 2025-03-25 10:24:31+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8641 2025-03-25 10:54:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll747pobsg2w 2025-03-25 13:38:27+00:00| seen| https://t.me/cvedetector/21086...

CVE-2025-27810

creationtimestamp| type| source ---|---|--- 2025-03-25 08:49:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll6va26o322s 2025-03-25 09:27:33+00:00| seen| https://t.me/cvedetector/21058...

CVE-2024-13122

creationtimestamp| type| source ---|---|--- 2025-03-25 06:23:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8606 2025-03-25 08:49:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ll6va2c76z24 2025-03-25 09:27:48+00:00| seen| https://t.me/cvedetector/21070...

CVE-2024-12769 Simple Banner < 3.0.4 - Admin+ Stored XSS

The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-2765

creationtimestamp| type| source ---|---|--- 2025-03-25 04:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-177/ 2025-04-23 20:32:35+00:00| seen| Telegram/Eg-knjjPTR9ocTVizjx2pI3zFSlAWu4SgE31pSS6iQco10 2025-04-23 21:10:30+00:00| seen| https://t.me/cvedetector/23609...

CVE-2025-2720

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data...

CVE-2025-30741

Pixelfed before 0.12.5 allows anyone to follow private accounts and see private posts on other Fediverse servers. This affects users elsewhere in the Fediverse, if they otherwise have any followers from a Pixelfed instance...

CVE-2025-2752

A vulnerability was found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This issue affects the function fastatorealmove in the library include/assimp/fastatof.h of the component CSM File Handler. The manipulation leads to out-of-bounds read. The attack may be initiated...

CVE-2025-2755

A vulnerability was found in Open Asset Import Library Assimp 5.4.3. It has been rated as critical. Affected by this issue is the function Assimp::AC3DImporter::ConvertObjectSection of the file code/AssetLib/AC/ACLoader.cpp of the component AC3D File Handler. The manipulation of the argument...