EUVD-2025-37973

The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verificationoverride=1. Because this value is...

CVE-2025-11271

The CVE-2025-11271 entry concerns WordPress Easy Digital Downloads (EDD) plugin versions up to and including 3.5.2. The vulnerability is an order verification bypass: the POST parameter verification_override=1 causes the verification check to be skipped unconditionally, enabling an attacker to su...

CVE-2025-64174: Improper Neutralization of Input During Web Page Generation

Magento-lts is a long-term support alternative to Magento Community Edition CE. Versions 20.15.0 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts...

PT-2025-45174

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions up to and including 3.5.2 Description The Easy Digital Downloads plugin for WordPress has a flaw that allows manipulation of orders. This is due to a bypass in order verification, which occurs when the...

ios-notification (0.0.4) potentially affected by CVE-2025-64458 via django (1.11.1)

django PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ios-notification 0.0.4 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2025-64458 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

archivebox (>=0.5.0, <=0.5.4), ashley (1.0.0b3) +7 more potentially affected by CVE-2025-64459 via django (3.1.3)

django PYPI version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - archivebox =0.5.0, =1.0.0, =1.0.0, =2.0.0a1, =2.1.1 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

ios-notification (0.0.4) potentially affected by CVE-2025-64459 via django (1.11.1)

django PYPI version 1.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - ios-notification 0.0.4 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...

CVE-2025-12412

The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on th tbnajaxadd function. This makes it possible for unauthenticated attackers to update the plugin's setting...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990362)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990362 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989853 advisory. In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't read past the mfuart notifcation In case the firmware sends a...

CVE-2025-55155 MantisBT: Authentication bypass for some passwords due to PHP type juggling

Mantis Bug Tracker MantisBT is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in storing an invalid email address, preventing...

Microsoft Teams Bugs Let Attackers Impersonate Colleagues and Edit Messages Unnoticed

Cybersecurity researchers have disclosed details of four security flaws in Microsoft Teams that could have exposed users to serious impersonation and social engineering attacks. The vulnerabilities "allowed attackers to manipulate conversations, impersonate colleagues, and exploit notifications,"...

WordPress Top Bar Notification plugin <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Top Bar Notification versions = 1.12...

CVE-2025-12412 Top Bar Notification <= 1.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Top Bar Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12. This is due to missing or incorrect nonce validation on th tbnajaxadd function. This makes it possible for unauthenticated attackers to update the plugin's setting...

CVE-2025-12412

The CVE-2025-12412 entry concerns the WordPress Top Bar Notification plugin (versions

CVE-2025-43309

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

CVE-2025-43309

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

CVE-2025-43309

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...

CVE-2025-43309: Improper Access Control

A logic issue was addressed with improved checks. This issue is fixed in iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen...