Mozilla Firefox < 3.0.15

The version of Firefox installed on the remote Windows host is prior to 3.0.15. It is, therefore, affected by a vulnerability as referenced in the mfsa2009-55 advisory. - Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary...

PT-2025-51989

Name of the Vulnerable Software and Affected Versions Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress versions through 2.7.10 Description The WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin contains a Stored Cross-Site...

Mozilla Firefox < 3.5.4

The version of Firefox installed on the remote Windows host is prior to 3.5.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2009-55 advisory. - Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, allows remote attackers to execute arbitrary co...

Denial Of Service (DoS)

getgrav/grav is vulnerable to Denial of Service DoS. The vulnerability is due to improper input validation in the “Supported” parameter of the Languages submenu, which allows an attacker to supply malformed input that triggers a fatal regular expression parsing error via the pregmatch function...

Server-Side Template Injection (SSTI)

getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to weak regex validation in the cleanDangerousTwig method, which allows an attacker to execute arbitrary commands on the server...

CVE-2025-13747

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nspshortcode function in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-13747

CVE-2025-13747 : The NewStatPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via a regex bypass in the nsp_shortcode function in all versions up to 1.4.3. Exploitation requires authentication at contributor level or higher and can inject scripts executed by users on injected pa...

CVE-2025-13747 NewStatPress <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nspshortcode function in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

Debian dla-4393 : python-mako-doc - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4393 advisory. - ----------------------------------------------------------------------- Debian LTS Advisory DLA-4393-1 [email protected] https://www.debian.org/lts/security/...

DoS (Denial of Service) ansi-regex Dependency in Jira Service Management Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in versions 10.3.13, and 11.2.0 of Jira Service Management Data Center and Server. This vulnerability with a CVSS Score of 7.5 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H allows an unauthenticated attacker...

CVE-2025-66305

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service DoS vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel /admin/config/system. Specifically, the Supported parameter fails to properly validate user input. If a malformed value ...

📄 libxml2 2.9.14 (2022) Heap Buffer Overflow

libxml2 version 2.9.14 2022 proof of concept exploit for a heap buffer overflow in the xmlRegEpxFromParse function in xmlregexp.c. ============================================================================================================================================= | Title : libxml2 2.9.14...

CVE-2025-66305 Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service DoS vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel /admin/config/system. Specifically, the Supported parameter fails to properly validate user input. If a malformed value ...

CVE-2025-66294

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Server-Side Template Injection SSTI vulnerability exists in Grav that allows authenticated attackers with editor permissions to execute arbitrary commands on the server and, under certain conditions, may also be exploited by...

PT-2025-48564

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service DoS vulnerability was identified in the "Languages" submenu of the Grav admin configuration panel /admin/config/system. Specifically, the Supported parameter fails to properly validate user input. If a malformed value ...

CLSA-2025-1764324770 Fix CVE(s): CVE-2022-30688

SECURITY UPDATE: insecure regex patterns for interpreter detection - debian/patches/CVE-2022-30688.patch: prevent local privilege escalation by anchoring interpreter regex patterns - CVE-2022-30688...

Regular Expression Denial of Service (ReDoS)

Overview valibot is a The modular and type safe schema library for validating structural data Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the EMOJIREGEX. An attacker can cause excessive CPU consumption and disrupt application availability by...

Malicious code in colors-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84ccf2bd5bd452f49978832d66685075c10f116c9cc007d7d8c31a2e001b3efe The package colors-regex was found to contain malicious code. Source: ghsa-malware 79632b803684fda175b5701ef644e5ef4e7791334d60bf8e8635cdb0f0d01164 A...

EUVD-2025-199094

Malicious code in colors-regex npm...

MAL-2025-190949 Malicious code in colors-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84ccf2bd5bd452f49978832d66685075c10f116c9cc007d7d8c31a2e001b3efe The package colors-regex was found to contain malicious code. Source: ghsa-malware 79632b803684fda175b5701ef644e5ef4e7791334d60bf8e8635cdb0f0d01164 A...