CVE-2025-47547 WordPress SendPulse Email Marketing Newsletter <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS. This issue affects SendPulse Email Marketing Newsletter: from n/a through 2.1.6...

CVE-2025-47546

CVE-2025-47546: CSRF in WordPress WP Compress

CGA-V43X-7RRM-XQ74

Bulletin has no description...

PT-2025-20136 · Unknown · Eli'S Related Posts Footer Links/Widget

Name of the Vulnerable Software and Affected Versions: ELI's Related Posts Footer Links and Widget versions 1.2.04.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...

GHSA-8GQJ-226H-GM8R Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling

Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response. Am I Affected? You are affected by this SAML Attribute Smuggling vulnerability if you are using...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

Missing Authorization to Unauthenticated Email Enumeration vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

CVE-2025-0984

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...

CGA-W77M-GMG8-89WW

Bulletin has no description...

nodejs:22 security update

nodejs 1:22.15.0-1 - Update to 22.15.0 - Drop upstream patches 1:22.13.1-4 - Patch fix for sqlite CVE-2025-31498 Resolves: RHEL-87300 1:22.13.1-3 - Update c-ares to newest version with fix for CVE-2025-31498 Resolves: RHEL-86581...

PT-2025-18688 · Gotenna · Gotenna Mesh

Name of the Vulnerable Software and Affected Versions: goTenna Mesh versions 5.5.3 with firmware 1.1.12 Description: A problem was discovered in goTenna Mesh devices where the verification token used for sending SMS through a goTenna server is hardcoded in the application. This issue affects...

CVE-2024-9876

CVE-2024-9876 describes a MAID (Modification of Assumed-Immutable Data) vulnerability affecting ABB ANC, ANC-L and ANC-mini up to version 1.1.4. The issue occurs in multiple ABB products (ANC through ANC-mini) with affected versions listed as 1.1.4 and earlier. Reported CVSS metrics indicate a hi...

PT-2025-18255 · Unknown · Phpgurukul Curfew E-Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Curfew e-Pass Management System version 1.0 Description: A critical issue affects the processing of the file /admin/edit-pass-detail.php. The manipulation of the editid argument leads to SQL injection. The attack may be initiated...

Fedora 40 : digikam (2025-97687e7f68)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-97687e7f68 advisory. update internal Libraw to 2025/03/17 snapshot Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

CVE-2025-46344 Auth0 NextJS SDK v4 Missing Session Invalidation

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke .setExpirationTime when generating a JWE token for the session. As a result, the JWE does not contain an internal expiration claim. While...

CVE-2025-39367

Missing Authorization vulnerability in SeventhQueen Kleo kleo.This issue affects Kleo: from n/a through 5.4.4...

CVE-2025-46436

Cross-Site Request Forgery CSRF vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Library: from n/a through = 0.4.1...

CVE-2025-46465

Cross-Site Request Forgery CSRF vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Science Designer: from n/a through = 1.3.155...

CVE-2025-2801

The The Create custom forms for WordPress with a smart form plugin for smart businesses plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.2.4. This is due to the software allowing users to execute an action that does not properly validate ...

CVE-2025-39563

Cross-Site Request Forgery CSRF vulnerability in WP Trio Conditional Payments for WooCommerce conditional-payments-for-woocommerce allows Cross Site Request Forgery.This issue affects Conditional Payments for WooCommerce: from n/a through = 3.3.0...

CVE-2025-39552

Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through = 3.3.200...