CVE-2025-34515

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in syncproject.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to...

CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in syncproject.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to...

WordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin MDTF versions = 1.3.3.8...

WordPress WPCasa plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin WPCasa versions = 1.4.1...

WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by R1sky in WordPress Plugin Acknowledgify versions = 1.1.3...

WordPress MasterStudy LMS plugin <= 3.6.20 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Bibek Dhakal in WordPress Plugin MasterStudy LMS versions = 3.6.20...

CVE-2025-39977

In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futexwaitrequeuepi futexdowait schedule futexrequeue futexproxytrylockatomic futexrequeuepiprepare requeuepiwakefutex...

CVE-2025-58115

ChatLuck (Guest User Sign-up) is affected by a cross-site scripting vulnerability (CVE-2025-58115). The issue allows arbitrary script execution in a user’s browser when signing up as a guest, per Red Hat, NVD, CVE listings and JVN. The vulnerability affects ChatLuck’s guest signup flow; root caus...

CVE-2025-58115

ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product...

EUVD-2025-34737

ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product...

CVE-2025-10303

The Library Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the owt7librarymanagementajaxhandler function in all versions up to, and including, 3.1. This makes it possible for authenticated attackers, with...

Multiple vulnerabilities in ChatLuck

Overview ChatLuck provided by NEOJAPAN Inc. contains multiple vulnerabilities listed below. Cross-site scripting vulnerability in Chat Rooms CWE-79 - CVE-2025-53858 Insufficient granularity of access control vulnerability in Invitation of Guest Users CWE-1220 - CVE-2025-54461 Cross-site scripting...

Malicious Package

Overview emittery-up is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

WordPress WP jQuery Pager plugin <= 1.4.0 - Authenticated (Contributor+) SQL Injection via Shortcode vulnerability

Authenticated Contributor+ SQL Injection via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin WP jQuery Pager versions = 1.4.0...

PT-2025-45294

Name of the Vulnerable Software and Affected Versions KALLYAS versions prior to 4.22.1 Description The KALLYAS Creative eCommerce Multi-Purpose WordPress Theme contains a missing authorization flaw. This occurs due to a missing capability check within a function, allowing authenticated attackers...

PT-2025-42450

Name of the Vulnerable Software and Affected Versions ChatLuck affected versions not specified Description ChatLuck contains a cross-site scripting issue in the Guest User Sign-up functionality. Successful exploitation could allow an attacker to execute arbitrary scripts in the web browser of a...

CVE-2025-58115: Improper Neutralization of Input During Web Page Generation

ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product...

Ilevia EVE X1 Server security vulnerabilities

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A security vulnerability exists in Ilevia EVE X1 Server version 4.7.18.0.eden and prior versions, which stems from storing passwords using the unsalted MD5 hash algorithm, which could lead to an offline dictionary...

CVE-2025-11619

Devolutions Server, a security solution for managing privileged accounts and sessions, is vulnerable to improper certificate validation when connecting to gateways. This flaw affects versions 2025.3.2 and earlier (specifically prior to 2025.3.3). An attacker positioned in a Man-in-the-Middle (Mit...

CVE-2025-58153 BIG-IP HSB vulnerability

Under undisclosed traffic conditions along with conditions beyond the attacker's control, hardware systems with a High-Speed Bridge HSB may experience a lockup of the HSB. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...