CVE-2025-25907

tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...

CVE-2024-13703

The CRM and Lead Management by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcitaajaxtoggleae function in all versions up to, and including, 2.7.5. This makes it possible for authenticated attackers, with Subscriber-level...

OSV-2025-202 UNKNOWN READ in _blit_xrgb32_lerp_spans

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=402836107 Crash type: UNKNOWN READ Crash state: blitxrgb32lerpspans cairorectangularscanconvertergenerate compositeboxes...

CVE-2025-20145

A vulnerability in the access control list ACL processing in the egress direction of Cisco IOS XR Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability exists because certain packets are handled incorrectly when they are received on an ingress...

CVE-2024-4259

Missing Authorization vulnerability in SAMPAŞ Holding AKOS AkosCepVatandasService, SAMPAŞ Holding AKOS TahsilatService allows Collect Data as Provided by Users. This issue affects AKOS AkosCepVatandasService: before V2.0; AKOS TahsilatService: before V1.0.7...

GHSA-6M2C-76FF-6VRF Qiskit allows arbitrary code execution decoding QPY format versions < 13

Impact A maliciously crafted QPY file can potentially execute arbitrary-code embedded in the payload without privilege escalation when deserializing QPY formats 13. A python process calling Qiskit's qiskit.qpy.load function could potentially execute any arbitrary Python code embedded in the corre...

BELL-CVE-2025-1736

Bulletin has no description...

BELL-CVE-2025-1217

Bulletin has no description...

BELL-CVE-2025-24855

Bulletin has no description...

CVE-2025-2207

A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The manipulation of the argument name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the...

CVE-2025-28912

Cross-Site Request Forgery CSRF vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through = 1.0...

CVE-2025-28884

Cross-Site Request Forgery CSRF vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue affects WP Bulk Post Duplicator: from n/a through = 1.2...

CVE-2025-28929

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through = 1.1.2...

CVE-2025-28871

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through = 2.2.4...

CVE-2025-28862

Cross-Site Request Forgery CSRF vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through = 1.0...

CVE-2025-28910

Cross-Site Request Forgery CSRF vulnerability in Ravinder Khurana WP Hide Admin Bar wp-hide-admin-bar allows Cross Site Request Forgery.This issue affects WP Hide Admin Bar: from n/a through = 2.0...

CVE-2025-28909

Cross-Site Request Forgery CSRF vulnerability in edwardw WP No-Bot Question wp-no-bot-question allows Cross Site Request Forgery.This issue affects WP No-Bot Question: from n/a through = 0.1.7...

CVE-2025-28859

Cross-Site Request Forgery CSRF vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maintenance Notice: from n/a through = 1.0.6...

CVE-2025-28919

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shellbot Easy Image Display easy-image-display allows Stored XSS.This issue affects Easy Image Display: from n/a through = 1.2.5...

CVE-2025-28856

Cross-Site Request Forgery CSRF vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through = 4.1...