2367 matches found
CVE-2025-67749
PCSX2 is a free and open-source PlayStation 2 PS2 emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory...
CVE-2025-8199
The MarqueeAddons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Testimonial Marquee widget in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-67721 Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via...
CVE-2025-13052 An improper certificates validation vulnerability was found in the Notification settings of ADM
When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traffic between the SMTP client and server to execute a man-in-the-middle MITM attack, which may obtain the sensitive...
pyrofork 路径遍历漏洞
pyrofork is an interface framework open-sourced by Mayuri-Chan. A path traversal vulnerability exists in pyrofork 2.3.68 and earlier versions, which stems from not properly cleaning up filenames and can lead to file path construction issues...
RHEL 9 : ruby:3.3 (RHSA-2025:23140)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:23140 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...
Moderate: Red Hat Security Advisory: ruby:3.3 security update
An update for the ruby:3.3 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2023-23729
Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.3.0...
Malicious code in @cheqplease/structured-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f4111b892bba0089b3619c99cd5135fa3693d4a78c790a23017e359beff0cd8 The package @cheqplease/structured-logger was found to contain malicious code. Source: ghsa-malware...
CVE-2025-63068
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in sevenspark Contact Form 7 – Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 – Dynamic Text Extension: from n/a through = 5.0.5...
CVE-2022-46845
CVE-2022-46845 affects the WordPress plugin Slider a SlidersPack (Image Slider, Post Slider, ACF Gallery Slider) prior to version 2.3. The issue is missing authorization due to incorrectly configured access control, allowing exploitation without authentication. Remediation: upgrade to Slider a Sl...
CVE-2025-63070
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through = 3.3.32...
CVE-2025-63024
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through = 4.3.1...
CVE-2025-49350
The CVE-2025-49350 entry concerns the WordPress Actionwear products sync plugin (versions up to 2.3.3). The root cause is a missing authorization due to incorrectly configured access control, leading to a broken access control vulnerability. Affected software is the Actionwear products sync plugi...
CVE-2025-49350 WordPress Actionwear products sync plugin <= 2.3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in marcoingraiti Actionwear products sync actionwear-products-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Actionwear products sync: from n/a through = 2.3.3...
CVE-2025-14324
CVE-2025-14324 describes a JIT miscompilation in the JavaScript Engine’s JIT component affecting Firefox < 146, Firefox ESR < 115.31 and < 140.6, and Thunderbird
Fortinet FortiAuthenticator 访问控制错误漏洞
Fortinet FortiAuthenticator is a centralized user identity management solution from Fortinet, Inc. An access control error vulnerability exists in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.4, all versions 6.5, all versions 6.4, and all versions 6.3, which stems from improper access...
LeptonCMS 安全漏洞
LeptonCMS is a content management system CMS from the Lepton Project. A security vulnerability exists in LeptonCMS version 7.3.0 that stems from insufficient file validation and could lead to the execution of arbitrary code...
PT-2025-49905
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Opal WP Fashion fashion2 allows PHP Local File Inclusion.This issue affects Fashion: from n/a through 5.3.0...
PT-2025-50036
Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through = 4.3.1...