Reflected Cross-Site Scripting (XSS)

NiceGUI is vulnerable to Reflected Cross-Site Scripting XSS. The vulnerability is due to improper sanitization or encoding in the ui.addcss, ui.addscss, and ui.addsass functions, which allows an attacker to inject closing tags and execute arbitrary JavaScript...

CVE-2025-14056 Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter

The Custom Post Type UI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'label' parameter during custom post type import in all versions up to, and including, 1.18.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress plugin Custom Post Type UI 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Custom Post Type UI plugin <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'label' Import Parameter vulnerability discovered by type5afe in WordPress Plugin Custom Post Type UI versions = 1.18.1...

CVE-2025-46287

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in watchOS 26.2, macOS Sonoma 14.8.3, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, macOS Sequoia 15.7.3, visionOS 26.2. An attacker may be able to spoof their FaceTi...

CVE-2025-12029

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious...

@inkeep/agents-manage-ui (>=0.0.0-dev-20251211233416, <=0.38.0), @react-email/preview-server (5.0.8) +1 more potentially affected by CVE-2025-55183 +2 more via next (16.0.9)

next NPM version 16.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @inkeep/agents-manage-ui =0.0.0-dev-20251211233416, =0.38.0 - @react-email/preview-server 5.0.8 - @tulip-systems/core 0.4.1 Source cves: CVE-2025-55183,...

About the security content of macOS Sonoma 14.8.3

About the security content of macOS Sonoma 14.8.3 This document describes the security content of macOS Sonoma 14.8.3. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

Vulnerabilities fixed in GitLab CE/EE

GitLab has fixed vulnerabilities in GitLab CE/EE. The vulnerabilities include several issues, including the ability for authenticated users to upload malicious images, perform unauthorized actions by injecting malicious HTML, obtain sensitive information through GraphQL queries, and bypass WebAut...

CVE-2025-12029

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious...

CVE-2025-12029 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious...

CVE-2025-12029

CVE-2025-12029 affects GitLab CE/EE across multiple branches: versions before 18.4.6 (15.11–18.4.5), 18.5 before 18.5.4, and 18.6 before 18.6.2. The issue allowed an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swa...

GHSA-38PP-6GCP-RQVM vulnerabilities

Vulnerabilities for packages: hubble-ui-backend-fips, hubble-ui...

CVE-2025-64715 vulnerabilities

Vulnerabilities for packages: hubble-ui-backend-fips, hubble-ui...

GHSA-38PP-6GCP-RQVM vulnerabilities

Vulnerabilities for packages: hubble-ui...

CVE-2025-64715 vulnerabilities

Vulnerabilities for packages: hubble-ui...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirecturl parameter when url.Parse....IsAbs is false. An attacker can redirect users to malicious sites by supplying a protocol-relative URL with an empty scheme, which is improperly validated and allows...

PT-2025-50779

Name of the Vulnerable Software and Affected Versions PDFsam Enhanced affected versions not specified Description A flaw exists in PDFsam Enhanced related to the processing of DOC files. The issue stems from allowing the execution of potentially harmful scripts without providing a warning to the...

PT-2025-50781

Name of the Vulnerable Software and Affected Versions PDFsam Enhanced affected versions not specified Description A flaw exists in PDFsam Enhanced related to the processing of XLS files. This allows a remote attacker to execute arbitrary code on affected systems. User interaction is required,...

PT-2025-50584

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 15.11 through 18.4.6 GitLab CE/EE versions 18.5 through 18.5.4 GitLab CE/EE versions 18.6 through 18.6.2 Description GitLab CE/EE is affected by an issue that, under certain circumstances, could allow an unauthenticated...