PT-2025-39291

Name of the Vulnerable Software and Affected Versions Cisco Wireless Access Point AP Software affected versions not specified Description A flaw exists in the Device Analytics action frame processing of Cisco Wireless Access Point AP Software. This issue could allow an unauthenticated attacker...

Cisco IOS XE Software 安全漏洞

Cisco IOS XE Software is a network operating system from Cisco USA. A security vulnerability exists in Cisco IOS XE Software that stems from an incomplete cleanup of the Day One setup process, which could allow an unauthenticated remote attacker to access the PKI server...

PT-2025-39292

Name of the Vulnerable Software and Affected Versions Cisco Access Point Software affected versions not specified Description A flaw exists in the IPv6 Router Advertisement RA packet processing that could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device...

WordPress plugin WPCasa 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A code injecti...

PT-2025-39227

Name of the Vulnerable Software and Affected Versions Click Plus C2-03CPU-2 version 3.60 Description An improper resource shutdown or release issue exists in the Click Plus C2-03CPU-2 device. An unauthenticated attacker can cause a denial-of-service by exhausting all available device sessions...

CVE-2025-26516

StorageGRID formerly StorageGRID Webscale versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node...

CVE-2025-9887 Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery

The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzkadminclsw.php file. This makes it possible for unauthenticated attackers to change the...

CVE-2025-9883

The CVE-2025-9883 entry concerns the WordPress plugin Browser Sniff (versions

CVE-2025-9949

CVE-2025-9949 (Internal Links Manager for WordPress) is a CSRF vulnerability present in all versions up to 3.0.1 due to missing or incorrect nonce validation in the link deletion path (process_bulk_action). This allows unauthenticated attackers to delete SEO links by tricking an administrator int...

CVE-2025-26516

StorageGRID formerly StorageGRID Webscale versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Denial of Service vulnerability. Successful exploit could allow an unauthenticated attacker to cause a Denial of Service on the Admin node...

CVE-2025-9629

The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0. This is due to missing or incorrect nonce validation on the usssettingpage function when processing the ussset form type. This makes it possible for unauthenticated attacker...

CVE-2025-47698

An adjacent attacker without authentication can exploit this vulnerability to retrieve a set of user-privileged credentials. These credentials are present during the firmware upgrade procedure...

CVE-2025-47698

CVE-2025-47698 affects Cognex In‑Sight devices (In‑Sight Explorer and related firmware). An adjacent, unauthenticated attacker can extract credentials that are present during the firmware upgrade procedure, facilitated by a hard‑coded password embedded in publicly available software. Impact per s...

Stored Cross-site Scripting (XSS)

com.liferay, com.liferay.journal.service is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper validation of user input in the web content text field, which allows a remote unauthenticated attacker to inject malicious JavaScript and execute it in the context of a...

CVE-2025-35436

CISA Thorium uses '.unwrap' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27...

CVE-2025-35432

CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes...

CVE-2025-35436 CISA Thorium account verification email error handling

CISA Thorium uses '.unwrap' to handle errors related to account verification email messages. An unauthenticated remote attacker could cause a crash by providing a specially crafted email address or response. Fixed in commit 6a65a27...

CVE-2025-35434 CISA Thorium does not validate TLS connections to Elasticsearch

CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2...

CVE-2025-35432 CISA Thorium does not rate limit account verification email messages

CISA Thorium does not rate limit requests to send account verification email messages. A remote unauthenticated attacker can send unlimited messages to a user who is pending verification. Fixed in 1.1.1 by adding a rate limit set by default to 10 minutes...

CVE-2025-10188

The Hack Repair Guy's Plugin Archiver for WordPress (up to v2.0.4) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation on the bulk_remove() function. This can allow unauthenticated attackers to cause arbitrary directory deletion in /wp-content if a site admin is ...