CVE-2025-61644 i18n XSS through Special:Watchlist

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from befo...

CVE-2025-61644

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from befo...

WordPress Royal Elementor Addons and Templates plugin <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting via Back to Top Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Back to Top Widget vulnerability discovered by wesley wcraft in WordPress Plugin Royal Elementor Addons versions = 1.3.975...

BIT-DISCOURSE-2025-69218 Discourse moderators can access admin-only reports exposing private upload URLs

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the topuploads admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive...

PT-2026-5732

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from befo...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: pgpool2exporter, amass, swagger, flux-notification-controller, ipfs-cluster, descheduler, kuma, aactl, kubernetes-dashboard-api, ingress-nginx-controller, gptscript, kubeflow-pipelines, minio-object-browser, tfsec, tofu-controller, terraform-docs,...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: nri-memcached, xcaddy, swagger, ipfs-cluster, aactl, kubernetes-dashboard-api, minio-object-browser, kubeflow-pipelines, nri-f5, flannel, crossplane-provider-aws-dynamodb, hydra, ytt, secrets-store-csi-driver, step-kms-plugin, pvc-autoresizer,...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: pgpool2exporter, amass, swagger, flux-notification-controller, ipfs-cluster, descheduler, kuma, aactl, kubernetes-dashboard-api, ingress-nginx-controller, gptscript, kubeflow-pipelines, minio-object-browser, nri-f5, tfsec, terraform-docs, tofu-controller,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: nri-memcached, xcaddy, swagger, ipfs-cluster, aactl, kubernetes-dashboard-api, minio-object-browser, kubeflow-pipelines, nri-f5, flannel, crossplane-provider-aws-dynamodb, hydra, ytt, secrets-store-csi-driver, step-kms-plugin, pvc-autoresizer,...

GHSA-GM9R-Q53W-2GH4 vulnerabilities

Vulnerabilities for packages: pgpool2exporter, amass, swagger, flux-notification-controller, ipfs-cluster, descheduler, kuma, aactl, kubernetes-dashboard-api, ingress-nginx-controller, gptscript, kubeflow-pipelines, minio-object-browser, tfsec, tofu-controller, terraform-docs,...

CVE-2025-61730 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, cilium-envoy, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp...

GHSA-GR56-3GP6-6GMJ vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, cilium-envoy, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp...

CVE-2025-61726 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, zitadel, cilium-envoy, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp, harbor-registry,...

CVE-2025-61731 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, cilium-envoy, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp...

CVE-2025-68119 vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp,...

GHSA-XVQR-69V8-F3GV vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, cilium-envoy, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp...

GHSA-CM6P-QC7V-M3JW vulnerabilities

Vulnerabilities for packages: secrets-store-csi-driver-provider-aws-fips, crossplane-provider-azure-sql, grpcurl-fips, harbor-registry-fips, crossplane-provider-aws-elasticache, knative-operator-fips, nri-haproxy-fips, zitadel, vitess, cerbos-fips, flux-fips, crossplane-provider-gcp,...

CVE-2026-23032 null_blk: fix kmemleak by releasing references to fault configfs items

In the Linux kernel, the following vulnerability has been resolved: nullblk: fix kmemleak by releasing references to fault configfs items When CONFIGBLKDEVNULLBLKFAULTINJECTION is enabled, the null-blk driver sets up fault injection support by creating the timeoutinject, requeueinject, and...

CVE-2025-69218

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the topuploads admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive...

CVE-2025-69218

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the topuploads admin report which should be restricted to admins only. This report displays direct URLs to all uploaded files on the site, including sensitive...