Linux Distros Unpatched Vulnerability : CVE-2020-13672

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site Scripting XSS vulnerability in Drupal core's sanitization API fails to properly filter cross- site scripting under certain circumstances. This issue...

MAL-2025-41339 Malicious code in typescript-5.7 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 689bcb9e8006cbddd0e9e75fb20e15aa8eed88e80f083873b7e694b997d62e58 The OpenSSF Package Analysis project identified 'typescript-5.7' @...

Malicious code in typescript-5.7 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 689bcb9e8006cbddd0e9e75fb20e15aa8eed88e80f083873b7e694b997d62e58 The OpenSSF Package Analysis project identified 'typescript-5.7' @...

GHSA-23W4-RPC6-WPCC Liferay Portal ReDoS with Role Name search in KaleoDesignerPortlet

Self-ReDoS Regular expression Denial of Service exists with Role Name search field of Kaleo Designer portlet JavaScript in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.1, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20...

WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Phat RiO in WordPress Plugin PDF for Contact Form 7 versions = 6.5.0...

Liferay Portal vulnerable to Stored XSS in Components portlet

Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote attackers to execute arbitrary web script or HTML via...

PT-2025-34514 · WordPress · Shortcodehub

Name of the Vulnerable Software and Affected Versions: ShortcodeHub plugin for WordPress versions up to and including 1.7.1 Description: The ShortcodeHub plugin for WordPress is susceptible to Stored Cross-Site Scripting via the author link target parameter due to insufficient input sanitization...

CVE-2025-9240

A security flaw has been discovered in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file /auth/info. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been released to the public and may be exploited...

CVE-2024-53499

Jeewms v3.7 was discovered to contain a SQL injection vulnerability via the CgReportController API...

CVE-2025-33120

IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges...

CVE-2025-33120

IBM QRadar SIEM 7.5 through 7.5.0 UP13 could allow an authenticated user to escalate their privileges via a misconfigured cronjob due to execution with unnecessary privileges...

CVE-2025-33120

IBM QRadar SIEM versions 7.5 through 7.5.0 UP13 are affected by a local privilege escalation due to a misconfigured cronjob that runs with unnecessary privileges. The vulnerability (CWE-250) allows an authenticated user to escalate privileges because the cronjob is executed with elevated rights. ...

Astra Linux – Vulnerability in p7zip, 7zip

7-Zip before version 25.01 does not always handle symbolic links correctly during extraction...

CVE-2025-47650

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through = 2.15.11...

CVE-2025-49396

Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through = 7.6.7...

CVE-2025-53196

Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through = 3.7.0...

CVE-2025-8145

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the getleadfields function. This makes it possible for unauthenticated attackers to inject a PHP Object. The addition...

CVE-2025-8289

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the deleteassociatedfiles function. This makes it possible for unauthenticated attackers to inject a PHP Object. This...

CVE-2025-8141

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteassociatedfiles function in all versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to delete arbitrary fil...

IBM QRadar SIEM 安全漏洞

IBM QRadar SIEM is a solution from International Business Machines IBM that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user...