CVE-2025-67989

Server-Side Request Forgery SSRF vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through = 4.1.3...

CVE-2025-66130 WordPress WP Views Counter plugin <= 2.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through = 2.1.2...

CVE-2025-64249

CVE-2025-64249 is a Missing Authorization vulnerability in Protect WP Admin. Wordfence reports it as an unauthenticated privilege escalation / unauthorized access issue affecting Protect WP Admin up to version 4.1; patch status in the report is Patched. No exploitation details are provided in the...

CVE-2025-64249 WordPress Protect WP Admin plugin <= 4.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Protect WP Admin: from n/a through = 4.1...

Moderate: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 7.1. This release updates to the latest version...

EUVD-2025-203470

A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/CtConfig.php of the component Backend System Configuration Module. The manipulation of the argument CjAdd/CjEdit results in code injection. Th...

PT-2025-51766

Name of the Vulnerable Software and Affected Versions Ctera Portal versions 8.1.x 8.1.1417.24 Description A Server-Side Request Forgery SSRF issue exists in Ctera Portal. This allows remote attackers to make arbitrary HTTP requests by providing a crafted HTML file containing an iframe. The...

CVE-2025-65581

An open redirect vulnerability exists in the Account module in Volosoft ABP Framework = 5.1.0 and 10.0.0-rc.2. Improper validation of the returnUrl parameter in the register function allows an attacker to redirect users to arbitrary external domains...

CVE-2025-14729 CTCMS Content Management System Backend App Configuration Ct_App.php save code injection

A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/CtApp.php of the component Backend App Configuration Module. The manipulation of the argument CTAppPaytype leads to code injection. Remote exploitation ...

CVE-2025-67897

In Sequoia before 2.1.0, aeskeyunwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

Sequoia PGP 安全漏洞

Sequoia PGP is a Rust library open-sourced by sequoia-pgp. A security vulnerability exists in Sequoia PGP versions prior to 2.1.0, which stems from the fact that aeskeyunwrap crashes when passing too short a ciphertext, potentially crashing the application...

WordPress Quick Testimonials plugin <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by Jochem Boender in WordPress Plugin Quick Testimonials versions = 2.1...

CVE-2025-13148

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password...

CVE-2025-13961

The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-12834

CVE-2025-12834 affects the WordPress plugin “Accept Stripe Payments Using Contact Form 7” and is due to insufficient input sanitization and output escaping in the failure_message parameter. The issue enables a Reflected XSS by unauthenticated attackers, who must lure a user to perform an action (...

CVE-2025-13052 An improper certificates validation vulnerability was found in the Notification settings of ADM

When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle MITM attack, which may obtain the sensitive...

Apple多款产品 安全漏洞

Apple iOS is an operating system for mobile devices, Apple watchOS is an operating system for smartwatches, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in several Apple products that stems from insufficient checks on email header parsing, which could...

WordPress plugin Accept Stripe Payments Using Contact Form 7 跨站脚本漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host a personal blog site on a PHP and MySQL based server.WordPress plug...

CVE-2025-13211 IBM Aspera Orchestrator Denial of Service

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency...

CVE-2025-13184

Unauthenticated Telnet enablement via cstecgi.cgi auth bypass leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369B20230113 arbitrary command execution. Earlier versions that share the same implementation, may also be affected...