CVE-2025-30147 ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curve

Besu Native contains scripts and tooling that is used to build and package the native libraries used by the Ethereum client Hyperledger Besu. Besu 24.7.1 through 25.2.2, corresponding to besu-native versions 0.9.0 through 1.2.1, have a potential consensus bug for the precompiles ALTBN128ADD 0x06,...

CVE-2025-46824

The Discourse Code Review Plugin allows users to review GitHub commits on Discourse. Prior to commit eed3a80, an attacker can execute arbitrary JavaScript on users' browsers by posting links to malicious GitHub commits. This problem is patched in commit eed3a80 of the discourse-code-review plugin...

CVE-2025-46824

The CVE-2025-46824 entry concerns the Discourse Code Review Plugin. Before commit eed3a80, an attacker could cause arbitrary JavaScript execution in a user’s browser by clicking links to malicious GitHub commits, effectively enabling an XSS vector in Discourse code review workflows. The issue is ...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

WordPress Easy PayPal Events plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Easy PayPal Events versions = 1.2.2...

WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Custom Checkout Fields for WooCommerce versions = 1.8.3...

WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Michael in WordPress Plugin Cost Calculator for Elementor versions = 1.3.3...

WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by luckybuddy in WordPress Plugin WP Hotel Booking versions = 2.1.9...

PT-2025-20039 · Unknown · Enrichedcall

Name of the Vulnerable Software and Affected Versions: EnrichedCall versions prior to SMR May-2025 Release 1 Description: The issue concerns the use of implicit intent for sensitive communication in EnrichedCall, allowing local attackers to access sensitive information. User interaction is requir...

PT-2025-20117 · Unknown · Contact Form Widget

Name of the Vulnerable Software and Affected Versions: Contact Form Widget versions 1.4.6 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Contact Form Widget, allowing unauthorized requests. Recommendations: For versions 1.4.6 and earlier, update to a version that...

PT-2025-20828

Name of the Vulnerable Software and Affected Versions Samsung MagicINFO 9 versions prior to 21.1052 Description An improper limitation of a pathname to a restricted directory issue exists in Samsung MagicINFO 9 Server. This allows attackers to write arbitrary files with system authority. The...

PT-2025-20162 · Unknown · Themefic Beaf

Name of the Vulnerable Software and Affected Versions: Themefic BEAF versions through 4.6.10 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited to gain unauthorized access to the server...

CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5

CVE-2025-2784 affecting package libsoup for versions less than 3.4.4-5. A patched version of the package is available...

CVE-2024-3447 affecting package qemu for versions less than 8.2.0-14

CVE-2024-3447 affecting package qemu for versions less than 8.2.0-14. A patched version of the package is available...

CVE-2025-46421 affecting package libsoup for versions less than 3.0.4-5

CVE-2025-46421 affecting package libsoup for versions less than 3.0.4-5. A patched version of the package is available...

WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...

CVE-2025-46815

ZITADEL Session API vulnerability (CVE-2025-46815) allows token/id reuse from idp intents prior to versions 3.0.0, 2.71.9, and 2.70.10. An attacker with URI access could obtain the id and token and authenticate on behalf of the user. MFA prevents full authentication, but this exposes a partial au...

GHSA-4VGF-2CM4-MP7C Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...

Terraform WinDNS Provider improperly sanitizes input variables in `windns_record`

Impact: A security issue has been found in terraform-provider-windns before version 1.0.5. The windnsrecord resource did not santize the input variables. This can lead to authenticated command injection in the underlyding powershell command prompt. Patches: 83ef736 fix: better input validation...

Azure Linux 3.0 Security Update: kernel (CVE-2025-21959)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21959 advisory. - In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: Fully initialize...