CVE-2025-31685

CVE-2025-31685 affects Drupal Open Social. A Missing Authorization vulnerability allows Forceful Browsing across Open Social versions affected: 0.0.0–12.3.10 and 12.4.0–12.4.9. Root cause is lack of proper access control, enabling unauthenticated access to otherwise restricted resources. Reported...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +511 more potentially affected by CVE-2025-31125 via vite (>=4.0.0, <=4.5.9)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-31125 Source advisory: OSV:GHSA-4R4M-QW57-CHR8...

WordPress Checkout Mestres do WP for WooCommerce 8.7.5 Missing Authentication

WordPress Checkout Mestres do WP for WooCommerce plugin versions 8.6.5 through 8.7.5 suffer from a missing authentication vulnerability that allows you to update options...

CVE-2025-31438

Cross-Site Request Forgery CSRF vulnerability in Benoit De Boeck WP Supersized wp-supersized allows Cross Site Request Forgery.This issue affects WP Supersized: from n/a through = 3.1.6...

CVE-2025-31094

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in teastudio.pl WP Posts Carousel wp-posts-carousel allows Stored XSS.This issue affects WP Posts Carousel: from n/a through = 1.3.8...

CVE-2025-31096

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through = 4.1.25...

CVE-2025-30779

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through = 2.10.7...

CVE-2025-30783

Cross-Site Request Forgery CSRF vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through = 16.0...

CVE-2024-12619 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects...

GO-2025-3526 Index out-of-range panic in github.com/onosproject/onos-lib-go

Index out-of-range panic in github.com/onosproject/onos-lib-go...

CVE-2025-30890

CVE-2025-30890 is a PHP Local File Inclusion flaw in the WordPress plugin “Login Widget for Ultimate Member,” caused by improper filename handling in include/require paths. Affected: Login Widget for Ultimate Member (versions up to 1.1.2). Impact (as per CVSS metrics): attacker can read/modify/ex...

CVE-2025-30823

CVE-2025-30823 describes a Cross-Site Request Forgery (CSRF) vulnerability in Anthologize, affecting versions from unspecified n/a up to 0.8.2. The description confirms a CSRF flaw but provides no root-cause details beyond the generic CSRF label and does not supply exploit conditions, affected en...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not validating the size range of an inline inode...

The vulnerability of the vorbis_analysis_wrote() function in the libsndfile library for reading and writing audio files allows a hacker to execute arbitrary code.

The vulnerability of the vorbisanalysiswrote function in the libsndfile library, a library for reading and writing audio files, is related to reading values outside of the allowed range. Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system...

The vulnerability of the sanity_check inode() function in the f2fs component of the Linux operating system allows a malicious actor to cause a service failure.

The vulnerability of the sanitycheck inode function in the f2fs component of the Linux operating system is related to errors in reading values that exceed the acceptable range. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2025-2600

Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATEDPASSWORD variable even though not allowed by the "Allow password in variable policy". This issue affects Remote Desktop Manager versions from 2025.1.24...

@clevercanyon/madrun (>=1.0.0, <=1.0.1), @snyk/snyk-cocoapods-plugin (2.6.0) +8 more potentially affected by CVE-2025-30222 via shescape (>=1.7.4, <=2.1.0)

shescape NPM version =1.7.4, =1.0.0, =0.1.2, =1.0.0, =1.0.0, =1.5.1, =6.5.0, =0.0.0-experimental-20221114-610843f6, =0.34.0-experimental.c2191de Source cves: CVE-2025-30222 Source advisory: OSV:GHSA-66PP-5P9W-Q87J...

CVE-2025-30540

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through = 1.2...

SUSE-SU-2025:1027-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2024-2201: Fixed information leak in x86/BHI bsc1217339. - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers bsc1228483. -...