WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Royal Elementor Addons versions = 1.7.1017...

CVE-2025-46421 affecting package libsoup for versions less than 3.4.4-5

CVE-2025-46421 affecting package libsoup for versions less than 3.4.4-5. A patched version of the package is available...

WordPress Frontend Dashboard plugin 1.0-2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Frontend Dashboard versions 1.0-2.2.6...

WordPress Relevanssi plugin <= 4.24.3 - Unauthenticated Stored Cross-Site Scripting via Search Highlights vulnerability

Unauthenticated Stored Cross-Site Scripting via Search Highlights vulnerability discovered by Jack Taylor in WordPress Plugin Relevanssi versions = 4.24.3...

WordPress CarDealerPress plugin <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via saleclass Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin CarDealerPress versions = 6.8.2505.00...

CVE-2025-46736 Umbraco Makes User Enumeration Feasible Based on Timing of Login Response

Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API responses, it's possible to determine whether an account exists. The issue is patched in versions 10.8.10 and 13.8.1. No known workarounds a...

CVE-2025-22872 affecting package cf-cli for versions less than 8.7.11-3

CVE-2025-22872 affecting package cf-cli for versions less than 8.7.11-3. A patched version of the package is available...

CVE-2025-46719

Open WebUI vulnerability CVE-2025-46719 affects versions prior to 0.6.6. A flaw in rendering certain HTML tags in chat messages allows stored cross-site scripting (XSS) in chat transcripts, which are accessible by other users on the same server or via Open WebUI community sharing. In the user’s b...

CVE-2025-43844

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, among others, take user input and pass it to the clicktrain function, which concatenates them into a command that is run on...

CVE-2024-50615 affecting package tinyxml2 for versions less than 9.0.0-2

CVE-2024-50615 affecting package tinyxml2 for versions less than 9.0.0-2. A patched version of the package is available...

CVE-2024-36899 affecting package kernel for versions less than 5.15.179.1-1

CVE-2024-36899 affecting package kernel for versions less than 5.15.179.1-1. A patched version of the package is available...

PT-2025-19765 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The issue arises from unsafe deserialization. The ckpt dir variable takes us...

PT-2025-19764 · Torch +2 · Torch +2

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: The issue concerns a voice changing framework based on VITS, where unsafe deserialization can occur. The ckpt a and cpkt b variables take user input, such as a...

CVE-2025-46554

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint...

CVE-2025-4210 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgradi...

WordPress Ultimate Auction Pro plugin <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id' vulnerability

Unauthenticated SQL Injection via 'auctionid' vulnerability discovered by Tom Broucke in WordPress Plugin Ultimate Auction Pro versions = 1.5.2...

WordPress FULL – Cliente plugin <= 3.1.25 - Authenticated (Subscriber+) SQL Injection

Authenticated Subscriber+ SQL Injection vulnerability discovered by kr0d in WordPress Plugin FULL Customer versions = 3.1.25...

WordPress Formality plugin <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Formality versions = 1.5.8...

GHSA-4PC9-X2FX-P7VJ @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Summary The OAuth implementation failed to check that redirecturi was among the allowed set for the clientid. Impact Under certain circumstances see below, if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visitin...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...