Microsoft OfficePlus Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

PT-2025-36893

Name of the Vulnerable Software and Affected Versions: Microsoft Office Plus affected versions not specified Description: The software contains an issue that allows an unauthorized attacker to perform spoofing over a network, potentially leading to exposure of sensitive information...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

CVE-2025-57665

Element Plus Link component el-link through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol...

PT-2025-36908

Name of the Vulnerable Software and Affected Versions: Element Plus versions through 2.10.6 Description: The Element Plus Link component el-link does not sufficiently validate input for the href attribute, creating a security gap. This allows attackers to inject malicious URLs using dangerous...

CVE-2025-57665

CVE-2025-57665 affects Element Plus Link component (el-link) up to version 2.10.6. The root cause is insufficient input validation of the href attribute, with user-controlled href values passed directly to underlying anchor elements without protocol validation, URL sanitization, or security heade...

Element Plus 安全漏洞

Element Plus is an open source Vue.js 3 UI library from the China Element Plus organization. A security vulnerability exists in Element Plus 2.10.6 and earlier versions, which stems from insufficient input validation of the href attribute and could lead to cross-site scripting attacks and phishin...

hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file()

...

hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()

...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

ManageEngine ServiceDesk Plus MSP < 14.9 Build 14940 Privilege Escalation

The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.9 Build 14940. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-8309 advisory. - A privilege escalation vulnerability caused by the overly permissive regular expression regex...

ManageEngine ServiceDesk Plus < 15.1 Build 15110 Privilege Escalation

The version of ManageEngine ServiceDesk Plus installed on the remote host is prior to 15.1 Build 15110. It is, therefore, affected by a vulnerability as referenced in the service-deskCVE-2025-8309 advisory. - A privilege escalation vulnerability caused by the overly permissive regular expression...

Grub2: fs/hfs+: refcount can be decremented twice

...

hfsplus: remove mutex_lock check in hfsplus_free_extents

...

HPACK table poisoning in gRPC C++, Python & Ruby

...

CVE-2025-58625

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58625 WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...

CVE-2025-58625

CVE-2025-58625 – WP Flow Plus stored XSS A cross-site scripting vulnerability exists in the WordPress plugin WP Flow Plus (Spiffy Plugins) affecting versions up to 5.2.5. The flaw stems from improper input neutralization during web page generation, enabling stored XSS. The CVSS v3.1 base score is...

CVE-2025-58625 WordPress WP Flow Plus Plugin <= 5.2.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through = 5.2.5...