CVE-2025-58444 MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

The MCP inspector is a developer tool for testing and debugging MCP servers. A cross-site scripting issue was reported in versions of the MCP Inspector local development tool prior to 0.16.6 when connecting to untrusted remote MCP servers with a malicious redirect URI. This could be leveraged to...

GHSA-G9HG-QHMF-Q45M MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server

An XSS flaw exists in the MCP Inspector local development tool when it renders a redirect URL returned by a remote MCP server. If the Inspector connects to an untrusted server, a crafted redirect can inject script into the Inspector context and, via the built-in proxy, be leveraged to trigger...

PT-2025-45518

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.80 Description A flaw exists in Google Chrome's Devtools due to insufficient policy enforcement. This issue could allow a remote attacker to leak cross-origin data through the Devtools functionality...

PT-2025-35675

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.53.6 Description: An improper access control issue exists in Galaxy Store. A local attacker can access protected data by exploiting an exported service. Recommendations: Update Galaxy Store to version 4.5.53...

PT-2025-35552

Name of the Vulnerable Software and Affected Versions: E3 Site Supervisor Control versions prior to 2.31F01 Description: The E3 Site Supervisor Control application services MGW and RCI utilize client-side hashing for authentication. This allows an attacker to authenticate by obtaining only the...

SUSE: Security Advisory (SUSE-SU-2025:03020-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : docker-buildx (2025-aeb4a7b52f)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-aeb4a7b52f advisory. - Update to release v0.27.0 - Resolves: rhvz2388453, rhbz2384137, rhbz2384154 - Upstream new features and fixes Tenable has extracted the preceding descripti...

PT-2025-35016

Name of the Vulnerable Software and Affected Versions: bxSlider integration for WordPress versions through 1.7.2 Description: The Vincent Mimoun-Prat bxSlider integration for WordPress contains a Stored Cross-Site Scripting XSS issue. The flaw resides in improper neutralization of input during we...

PT-2025-34747 · WordPress · Tourfic

Name of the Vulnerable Software and Affected Versions: Tourfic plugin for WordPress versions up to and including 2.14.5 Description: The Tourfic plugin for WordPress is susceptible to unauthorized data modification due to a missing capability check in the following functions: tf order status emai...

PT-2025-34458 · Reolink · Reolink Smart 2K+ Plug-In Wi-Fi Video Doorbell With Chime

Name of the Vulnerable Software and Affected Versions: Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime version 3.0.0.4662 2503122283 Description: The device suffers from insufficient privilege verification. Authenticated attackers can create accounts with elevated privileges...

govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media (moderate)

govulncheck-vulndb-0.0.20250818T190335-1.1 on GA media Announcement ID: openSUSE-SU-2025:15470-1 Rating: moderate Cross-References: CVE-2023-26154 CVE-2025-44001 CVE-2025-44004 CVE-2025-48731 CVE-2025-49221 CVE-2025-50946 CVE-2025-52931 CVE-2025-53514 CVE-2025-53857 CVE-2025-53910 CVE-2025-54458...

TencentOS Server 3: python3.11-setuptools (TSSA-2025:0685)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0685 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Important Photon OS Security Update - PHSA-2025-4.0-0854

Updates of 'gnutls' packages of Photon OS have been released...

KLA86789 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Memory corruption vulnerability in the GMP process can be exploited to execute...

PT-2025-33865 · Unknown · Solidinvoice

Name of the Vulnerable Software and Affected Versions: SolidInvoice versions prior to 2.4.1 Description: A vulnerability exists in SolidInvoice that allows for cross site scripting. The issue affects unknown code within the /invoice/recurring file of the Recurring Invoice Module. Manipulation of...

WordPress ProfilePress plugin <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by WordFence in WordPress Plugin ProfilePress versions = 4.16.4...

Security update for rust-keylime

This update for rust-keylime fixes the following issues: Update to version 0.2.7+141: CVE-2025-58266: shlex: Fixed command injection bsc1247193 Update to version 0.2.7+117: CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RSTSTREAM frames bsc1210344. CVE-2024-12224...

PT-2025-33466 · WordPress · Plugin Readme Parser

Name of the Vulnerable Software and Affected Versions: Plugin README Parser versions up to and including 1.3.15 Description: The Plugin README Parser plugin for WordPress is susceptible to Stored Cross-Site Scripting via the target parameter due to insufficient input sanitization and output...

PT-2025-33460 · WordPress · Bizcalendar Web

Name of the Vulnerable Software and Affected Versions: BizCalendar Web plugin for WordPress versions prior to 1.1.0.51 Description: The BizCalendar Web plugin for WordPress is vulnerable to Local File Inclusion via the bizcalv shortcode. Authenticated attackers with Contributor-level access and...

Schneider Electric Software Update < 3.0.12 Privilege Escalation

The version of Schneider Electric Software Update installed on the remote host is prior to 3.0.12. It is, therefore, affected by a link following vulnerability that allows arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruptio...