WordPress plugin TheGem 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

Microsoft Windows 安全漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft USA. A security vulnerability exists in Microsoft Windows. An attacker exploiting this vulnerability could gain access to sensitive information. The following products and versions are affected:Windows 10...

Microsoft Windows Media Foundation 安全漏洞

Microsoft Windows Media Foundation is a multimedia development library from Microsoft that aims to provide a unified multimedia solution for the Windows platform, allowing developers to play video and sound files, encode or transcode multimedia files, and so on. Developers can use Media Foundatio...

Important: tomcat10

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException...

Microsoft Windows Hardware Lab Kit 信任管理问题漏洞

Microsoft Windows Hardware Lab Kit is a test framework from Microsoft Corporation USA used to verify the compatibility of hardware devices and drivers with the Windows operating system. A trust management issue vulnerability exists in Microsoft Windows Hardware Lab Kit. An attacker could exploit...

WordPress TheGem plugin <= 5.10.3 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Theme TheGem versions = 5.10.3...

HPESBHF04861 rev.2 - Certain HPE ProLiant DL/ML, MicroServer, Synergy and Edgeline Servers Using Certain Intel Processor BIOS, INTEL-SA-01153, 2025.1 IPU, Intel Processor Advisory, Local Disclosure of Information Vulnerability

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL110 Gen10 Plus Telco server - Prior to v2.3001-16-2025 HPE ProLiant DL380 Gen10 Plus server - Prior to v2.3001-16-2025 HPE ProLiant DL360 Gen10 Plus server -...

WordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by domiee13 in WordPress Plugin FunnelCockpit versions = 1.4.3...

CVE-2025-47509

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Top 10 top-10 allows Stored XSS.This issue affects Top 10: from n/a through = 4.1.0...

CVE-2025-1329

IBM CICS TX Standard 11.1 and IBM CICS TX Advanced 10.1 and 11.1 could allow a local user to execute arbitrary code on the system due to failure to handle DNS return requests by the gethostbyaddr function...

Critical Photon OS Security Update - PHSA-2025-5.0-0519

Updates of 'subversion', 'apache-tomcat10', 'apache-tomcat9' packages of Photon OS have been released...

Horner Automation Cscape 缓冲区错误漏洞

Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A buffer error vulnerability exists in Horner Automation Cscape version 10.0 that originates from an out-of-bounds read and could allow an attacker to disclose information...

Critical Photon OS Security Update - PHSA-2025-5.0-91-0519

Updates of 'apache-tomcat9', 'apache-tomcat10', 'subversion' packages of Photon OS have been released...

CVE-2025-47509 WordPress Top 10 plugin <= 4.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ajay Top 10 top-10 allows Stored XSS.This issue affects Top 10: from n/a through = 4.1.0...

Sunnet eHRD CTMS SQL注入漏洞

Sunnet eHRD CTMS is a Human Resource Development and Clinical Training Management System from China Sunnet Sunnet. A SQL injection vulnerability exists in Sunnet eHRD CTMS version 10.13 and prior versions, which stems from a SQL injection vulnerability that could allow a remote attacker to read...

PYSEC-2025-178

OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing a user to change attributes that are intended to be unmodifiable by the user. It is possible to toggle the external flag on/off and change...

USN-7315-2 postgresql-10 vulnerability

USN-7315-1 fixed a vulnerability in PostgreSQL. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: Stephen Fewer discovered that PostgreSQL incorrectly handled quoting syntax in certain scenarios. A remote attacker could possibly use this issue to perfo...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6...

WordPress Mini twitter feed plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by johska in WordPress Plugin Mini twitter feed versions = 3.0...

CVE-2024-47829 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting

pnpm is a package manager. Prior to version 10.0.0, the path shortening function uses the md5 function as a path shortening compression function, and if a collision occurs, it will result in the same storage path for two different libraries. Although the real names are under the package name...