CVE-2025-62012

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CodexThemes TheGem Elementor thegem-elementor.This issue affects TheGem Elementor: from n/a through = 5.10.5...

CVE-2025-62046

CVE-2025-62046: WordPress TheGem Demo Import (for WPBakery) plugin up to version 5.10.5 has a Missing Authorization vulnerability that can lead to Arbitrary Content Deletion. Affected software: TheGem Demo Import (for WPBakery). Base CVSS v3.1 score: 6.5 (Medium). Connected sources confirm the is...

CVE-2025-62012

CVE-2025-62012 affects WordPress TheGem (Elementor) theme and related TheGem elements: thegem-elementor. The vulnerability is caused by improper neutralization of input during web page generation, resulting in a Cross-Site Scripting (XSS) issue. Affected versions are

CVE-2025-58972 WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.10.4 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through =...

CVE-2025-58592 WordPress TranslatePress Plugin <= 2.10.2 - Deserialization of untrusted data Vulnerability

Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through = 2.10.2...

expat security update

An update is available for expat. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Expat is a C library for parsing XML documents. Security Fixes: expat: libexpa...

valkey security update

An update is available for valkey. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Valkey is an advanced key-value store. It is often referred to as a data...

Hackers Weaponize Windows Hyper-V to Hide Linux VM and Evade EDR Detection

The threat actor known as Curly COMrades has been observed exploiting virtualization technologies as a way to bypass security solutions and execute custom malware. According to a new report from Bitdefender, the adversary is said to have enabled the Hyper-V role on selected victim systems to depl...

CVE-2025-61994

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...

CVE-2025-61994

GROWI is affected by CVE-2025-61994: stored cross-site scripting in versions prior to 7.2.10 when a page with crafted content is created, potentially allowing arbitrary script execution in a victim’s browser. Remediation: upgrade to GROWI 7.3.0 or later (per JVN/Red Hat advisories). Other sources...

CVE-2025-61994

Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing crafted contents, an arbitrary script may be executed on the web browser of a victim user who accesses the page...

CVE-2025-64164 DataEase is vulnerable to Oracle JNDI Injection

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection Java Naming and Directory Interface injection. This issue is fixed in version 2.10.15...

PT-2025-45173

Name of the Vulnerable Software and Affected Versions GROWI versions prior to 7.2.10 Description A cross-site scripting issue exists. A malicious user can execute arbitrary scripts in a victim's web browser by creating a page with crafted content. Recommendations Update GROWI to version 7.2.10 or...

PT-2025-45170

Name of the Vulnerable Software and Affected Versions Dataease versions 2.10.14 and below Description Dataease is an open source data visualization analysis tool. Versions 2.10.14 and below do not properly filter when establishing JDBC connections to Oracle, which can lead to a Java Naming and...

WordPress plugin TheGem (Elementor) 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that provides the ability to host a personal blog site on a PHP and MySQL based server. A cross-site scripting...

CVE-2025-43990

Dell Command Monitor DCM, versions prior to 10.12.3.28, contains an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges...

RHSA-2025:19572 Red Hat Security Advisory: mariadb:10.5 security update

Bulletin has no description...

10 Successful Marketplaces Built on Sharetribe: Lessons Learned

The marketplace revolution is here, and it's transforming how we buy, sell, and share everything from vintage furniture…...

[SECURITY] Fedora 43 Update: python-pydantic-extra-types-2.10.6-2.fc43

A place for pydantic types that probably shouldn't exist in the main pydantic library...

WordPress The Events Calendar plugin <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability

Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability discovered by mikemyers in WordPress Plugin The Events Calendar versions = 6.15.9...