CVE-2026-21451 Bagisto has HTML Filter Bypass that Enables Stored XSS

Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting XSS vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST...

CVE-2026-21446

Bagisto is an open source laravel eCommerce platform. In versions on the 2.3 branch prior to 2.3.10, API routes remain active even after initial installation is complete. The underlying API endpoints /install/api/ are directly accessible and exploitable without any authentication. An attacker can...

CVE-2025-15437 LigeroSmart Environment Variable cross site scripting

A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUESTURI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could...

PT-2026-4994

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.3 Suricata versions prior to 7.0.14 Description Suricata is a network IDS, IPS and NSM engine. A stack buffer overflow can occur while saving a dataset due to the use of a stack buffer to prepare the data. If the...

CVE-2025-62084 WordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Imdad Next Web iNext Woo Pincode Checker inext-woo-pincode-checker allows Cross Site Request Forgery.This issue affects iNext Woo Pincode Checker: from n/a through = 2.3.1...

EUVD-2025-205954

Cross-Site Request Forgery CSRF vulnerability in Rick Beckman OpenHook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through 4.3.1...

GHSA-59PP-R3RG-353G Composer is vulnerable to ANSI sequence injection

Impact Attackers controlling remote sources that Composer downloads from might in some way inject ANSI control characters in the terminal output of various Composer commands, causing mangled output and potentially leading to confusion or DoS of the terminal application. There is no proven exploit...

Fedora 43 : singularity-ce (2025-d3cd3e7cf0)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d3cd3e7cf0 advisory. Upgrade to 4.3.6 upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2025-68605

CVE-2025-68605 concerns the WordPress Post Grid and Post Grid Gutenberg Blocks. The connected Wordfence details confirm a Stored XSS issue in Post Grid and Gutenberg Blocks versions up to 2.3.x (the CVE entry references 2.3.21 as a ceiling in the vulnerability listing). The description indicates ...

CVE-2025-67108

eProsima Fast-DDS v3.3 was discovered to contain improper validation for ticket revocation, resulting in insecure communications and connections...

PT-2025-52763

Name of the Vulnerable Software and Affected Versions eProsima Fast-DDS version 3.3 Description An integer overflow in eProsima Fast-DDS v3.3 can allow attackers to cause a Denial of Service DoS through a specially crafted input. Recommendations At the moment, there is no information about a newe...

Umbraco CMS 安全漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS version v16.3.3, which stems from the fact that uploading a specially crafted PDF file may result in the execution of arbitrary code...

CVE-2025-63043

Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through = 2.3.23...

CVE-2025-63043

CVE-2025-63043 is an IDOR-by-auth bypass in the WordPress Post Grid and Gutenberg Blocks plugin (versions up to 2.3.19 as reported). The vulnerability arises from authorization by a user-controlled key, enabling access control bypass to restricted objects. Several connected sources confirm the af...

CVE-2025-64723

Summary: Arduino IDE for macOS prior to 2.3.7 had overly permissive security entitlements that could bypass the macOS Hardened Runtime protections, enabling an attacker to inject malicious dynamic libraries into the process and access all TCC permissions granted to the app. Impact (as stated): by...

EUVD-2025-204069

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Retrieve Embedded Sensitive Data.This issue affects Follow My Blog Post: from n/a through = 2.3.9...

EUVD-2025-204108

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through = 6.3.0...

CVE-2025-66116

Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Member Widgets for Elementor: from n/a through = 2.3...

CVE-2025-60080

Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through = 6.5.0...

CVE-2025-58708

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in axiomthemes 777 triple-seven allows PHP Local File Inclusion.This issue affects 777: from n/a through = 1.3...