1455 matches found
CVE-2025-10684
The Construction Light WordPress theme, in versions prior to 1.6.8 , is vulnerable to an improper authorization and Cross-Site Request Forgery (CSRF) flaw. The root cause is a lack of permission verification and CSRF token validation during AJAX actions used for activating features. This allows a...
CVE-2025-10684 Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary...
CVE-2025-10684 Construction Light < 1.6.8 - Subscriber+ Arbitrary Plugin Activation
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary...
WordPress plugin Construction Light 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
CVE-2025-10684: Improper Authentication
The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users, such as subscriber to activate arbitrary...
The vulnerability of the iio/light/as73211.c component in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the iio/light/as73211.c component in the Linux operating system is related to the copying of buffers without checking the input data. Exploiting this vulnerability allows an attacker to cause a service failure...
@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.38), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.38) potentially affected by CVE-2025-66412 via @angular/compiler (>=21.0.0, <=21.0.1)
@angular/compiler NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.38 Source cves: CVE-2025-66412 Source advisory: OSV:GHSA-V4HV-RGFQ-GP49...
@eui/deps-base (>=21.0.0-alpha.10, <=21.0.0-next.28), @eui/deps-base-light (>=21.0.0-alpha.10, <=21.0.0-next.28) potentially affected by CVE-2025-66035 via @angular/common (21.0.0-rc.2)
@angular/common NPM version 21.0.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/common and may be impacted: - @eui/deps-base =21.0.0-alpha.10, =21.0.0-alpha.10, =21.0.0-next.28 Source cves: CVE-2025-66035 Source advisory:...
PT-2025-41: The Twinkly Light Tree 3D firmware uses a vulnerable Blufi library
The vulnerability was identified in the Twinkly Light Tree 3D firmware, 2.8.18. An attacker within Bluetooth range, with physical access to a device running firmware prior to 2.9.0 and provisioning mode manually re-enabled could, in an attack scenario, interfere with the provisioning exchange and...
AZL-70850 CVE-2025-65018 affecting package fltk 1.3.8-1
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API function pngimagefinishread when processing...
The vulnerability of the ULCL (Ultra Light Client) component of the Navis N4 operating system, which allows a hacker to execute arbitrary code.
The vulnerability of the ULCLight Client component of the Navis N4 operating system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
EUVD-2025-117267
Malicious code in light-amber-eel npm...
MAL-2025-138835 Malicious code in light-amber-eel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c95233b8c518f92b155ea0056d0b872fbece596329cb8f1af94691d20ed9cd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-104225
Malicious code in lightclownfishz3n npm...
MAL-2025-128180 Malicious code in light_clownfish_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e53b8ae19519928b5a837a004367ed305cc815ba2e5b930fbac535bb956b44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-96848
Malicious code in lightferretz3n npm...
EUVD-2025-77581
Malicious code in lightbandicootolive-46 npm...
EUVD-2025-78901
Malicious code in lighttigerz3n npm...