WordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin xili-language versions = 2.21.2...

WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Enable Media Replace versions = 4.1.5...

CVE-2025-21941

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipectx-planestate in resourcebuildscalingparams Null pointer dereference issue could occur when pipectx-planestate is null. The fix adds a check to ensure 'pipectx-planestate' is not null befo...

WordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Perfect Font Awesome Integration versions = 2.3...

CVE-2025-21958

In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovsctsetlabels is only called for confirmed conntrack entries ct within ovsctcommit. However, if the conntrack entry does not have the labelsext...

CVE-2025-21936 Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmtallocskb in mgmtdeviceconnected Add check for the return value of mgmtallocskb in mgmtdeviceconnected to prevent null pointer dereference...

CVE-2025-21909

CVE-2025-21909 concerns the Linux kernel wifi/nl80211 subsystem. Description: when a monitor interface is set with MONITOR_FLAG_COOK_FRAMES together with other MONITOR flags, a sub-interface can be created without the IEEE80211_SDATA_IN_DRIVER bit, since cooked state takes precedence over other s...

GHSA-Q8JQ-4RM5-4HM5 @alizeait/unflatto Prototype Pollution

Impact alizeait unflatto = 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. Patches The problem has been patch...

@alizeait/unflatto Prototype Pollution

Impact alizeait unflatto = 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/index.js. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. Patches The problem has been patch...

Rancher: Restricted Administrator can change Administrator's passwords

Impact A vulnerability has been identified within Rancher where a Restricted Administrator can change the password of Administrators and take over their accounts. A Restricted Administrator should be not allowed to change the password of more privileged users unless it contains the Manage Users...

WordPress SimplyRETS Real Estate IDX plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Psai in WordPress Plugin SimplyRETS Real Estate IDX versions = 3.1.1...

ats.nethire.com Cross Site Scripting vulnerability OBB-4041548

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Important: ghostscript

Issue Overview: The calculation of the buffer size was being done with int values, and overflowing that data type. The bug has existed since the creation of the file contrib/japanese/gdevnpdl.c The calculation of the buffer size was being done with int values, and overflowing that data type. By...

PT-2025-14060 · Wpquads · Wpquads

Name of the Vulnerable Software and Affected Versions: Ads by WPQuads versions prior to 2.0.87.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for unauthorized access. Recommendations: For...

PT-2025-14167 · Woocommerce · Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: ahmadshyk Gift Cards for WooCommerce versions 1.5.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendation...

PT-2025-14213 · Themeglow · Themeglow Jobboard Job Listing

Name of the Vulnerable Software and Affected Versions: themeglow JobBoard Job listing versions 1.2.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For...

EulerOS 2.0 SP13 : binutils (EulerOS-SA-2025-1329)

According to the versions of the binutils package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : https://www.gnu.org/software/binutils/ nm =2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: n...

Apple MacOSX Security Update (HT122373)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

sudo -- privilege escalation vulnerability through host and chroot options

Todd C. Miller reports, crediting Rich Mirch from Stratascale Cyber Research Unit CRU: Sudo 1.9.17p1: Fixed CVE-2025-32462. Sudo's -h --host option could be specified when running a command or editing a file. This could enable a local privilege escalation attack if the sudoers file allows the use...

CVE-2025-24257

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected system termination or write kernel memory...