Mozilla Firefox < 60.0.2

The version of Firefox installed on the remote Windows host is prior to 60.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2018-14 advisory. - A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file with...

Mozilla Firefox ESR < 52.8.1

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 52.8.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2018-14 advisory. - A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file...

Mozilla Thunderbird < 52.8

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 52.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-13 advisory. - Mozilla developers backported selected changes in the Skia library. These changes correct memory corrupti...

Mozilla Firefox < 59.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 59.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-06 advisory. - A use-after-free vulnerability can occur when manipulating elements, events, and selection ranges during edit...

Mozilla Firefox ESR < 60.0.2

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 60.0.2. It is, therefore, affected by a vulnerability as referenced in the mfsa2018-14 advisory. - A heap buffer overflow can occur in the Skia library when rasterizing paths using a maliciously crafted SVG file...

Mozilla Firefox < 57.0.1

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 57.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-27 advisory. - When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB a...

CVE-2025-63830

CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...

CVE-2025-63830

CKFinder v1.4.3 is vulnerable to Stored Cross-Site Scripting (XSS) due to a lack of proper sanitization in the File Upload function. An attacker can upload a specially crafted SVG file containing active content, such as [removed] tags, onload handlers, or elements. When a victim subsequently acc...

CVE-2025-63830: Improper Neutralization of Input During Web Page Generation

CKFinder 1.4.3 is vulnerable to Cross Site Scripting XSS in the File Upload function. An attacker can upload a crafted SVG containing active content...

CVE-2025-12846

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a vali...

qtsvg: Use-after-free vulnerability in Qt SVG

A use after free flaw has been discovered in the Qt SVG library. The qsvghandler.cpp module will parse a node which is not a child of a structural node. The node will be deleted after creation but might be accessed later leading to a use after free...

EUVD-2025-84359

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a vali...

CVE-2025-12846 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a vali...

CVE-2025-12846 Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a vali...

CVE-2025-12846

CVE-2025-12846 affects Blocksy Companion for WordPress (versions

CVE-2025-12880

The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-leve...

CVE-2025-12880

CVE-2025-12880 concerns the WordPress plugin Progress Bar Blocks for Gutenberg . The issue is a Stored Cross-Site Scripting (XSS) vulnerability via SVG file uploads caused by insufficient input sanitization and output escaping. It affects all versions up to and including 1.0.0, with exploitation ...

RHEL 10 : qt6-qtsvg (RHSA-2025:21037)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21037 advisory. Scalable Vector Graphics SVG is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and...

CVE-2025-12880: Improper Neutralization of Input During Web Page Generation

The Progress Bar Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-leve...

CVE-2025-12846: Unrestricted Upload of File with Dangerous Type

The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to insufficient file type validation detecting SVG files, allowing double extension files to bypass sanitization while being accepted as a vali...