82,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in TheGem WordPress Theme

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On May 4th, 2025, we received a submission for an Arbitrary File Upload...

Dropbear < 2025.88 Command Injection Vulnerability

Dropbear is prone to a command injection vulnerability in dbclient. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

EulerOS 2.0 SP10 : git (EulerOS-SA-2025-1513)

According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Git is a source code management tool. When cloning from a server or fetching, or pushing, informational or error messages are transported from the...

PT-2025-20782 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.5 Description: An information disclosure issue was addressed with improved privacy controls. This issue allows an app to potentially access sensitive user data. Recommendations: For versions prior to 15.5, update to...

PT-2025-20472 · Unknown · Trailer Crate

Name of the Vulnerable Software and Affected Versions: trailer crate versions 0.1.2 and earlier Description: The issue is related to the lib.rs file in the trailer crate for Rust, which mishandles allocating with a size of zero. Recommendations: For trailer crate version 0.1.2 and earlier, consid...

10,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Eventin WordPress Plugin

📢In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. On April 6th, 2025, we received a submission for an Arbitrary File Read...

PT-2025-19914

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search plugin for WordPress versions up to, and including, 4.24.3 Description The issue is related to Stored Cross-Site Scripting via the highlights functionality due to insufficient input sanitization and output escaping...

PT-2025-20142 · Unknown · Charitable

Name of the Vulnerable Software and Affected Versions: Charitable versions 1.8.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious...

RockyLinux 8 : cups (RLSA-2024:4265)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4265 advisory. cups: Cupsd Listen arbitrary chmod 0140777 CVE-2024-35235 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. No...

PT-2025-20131 · Unknown · Ajay Better Search

Name of the Vulnerable Software and Affected Versions: Ajay Better Search versions n/a through 4.1.0 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. Recommendations: For versions...

PT-2025-20156 · Unknown · Truebooker

Name of the Vulnerable Software and Affected Versions: TrueBooker versions 1.0.7 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 1.0.7 and earlier, update to a...

PT-2025-20227 · Unknown · Moloni Contribuinte Checkout

Name of the Vulnerable Software and Affected Versions: Moloni Contribuinte Checkout versions n/a through 2.0.02 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-20113 · Cyberchimps · Cyberchimps Gutenberg & Elementor Templates Importer For Responsive

Name of the Vulnerable Software and Affected Versions: CyberChimps Gutenberg & Elementor Templates Importer For Responsive versions 3.1.9 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs...

PT-2025-20144 · Unknown · Aweos Wp Lock

Name of the Vulnerable Software and Affected Versions: AWEOS WP Lock versions 1.4.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious...

PT-2025-20168 · Unknown · Creedally Bulk Featured Image

Name of the Vulnerable Software and Affected Versions: CreedAlly Bulk Featured Image versions 1.2.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For CreedAlly...

PT-2025-20137 · Unknown · Seb Wp Dpe-Ges

Name of the Vulnerable Software and Affected Versions: Seb WP DPE-GES versions 1.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

PT-2025-20161 · Wbcom Designs · Activity Link Preview For Buddypress

Name of the Vulnerable Software and Affected Versions: Wbcom Designs - Activity Link Preview For BuddyPress versions 1.4.4 and earlier Description: A Server-Side Request Forgery SSRF issue affects the software, allowing for Server Side Request Forgery. Recommendations: For versions 1.4.4 and...

PT-2025-20321

Name of the Vulnerable Software and Affected Versions UniFi Protect Cameras versions 4.75.43 and earlier Description A malicious actor with access to the management network could execute a remote code execution RCE by exploiting a heap buffer overflow vulnerability in the UniFi Protect Cameras...

PT-2025-19959 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.3 Description: A SQL injection issue was discovered in the admin comment news.php component. Recommendations: For SeaCMS version 13.3, update to a version that fixes the SQL injection vulnerability in the admin comment...

PT-2025-19892 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.3 Description: The issue allows a local attacker to cause a denial of service DOS through a NULL pointer dereference. Recommendations: For versions prior to 5.0.3, update to a version that contains a fix for...