n8n is vulnerable to Improper Authorization through its `/stop` endpoint

Summary An authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n. An authenticated user can stop workflow executions that they do not own or that have not been shared with them, leading to potential business disruption. Impact This is an improper authorizatio...

CVE-2025-27461

CVE-2025-27461 affects the Endress+Hauser MEAC300-FNADE4 emissions data management device. The root cause is startup-time automatic login of the EPC2 Windows user without a password, effectively bypassing authentication and enabling full access where the device is physically reachable. The CVE is...

CVE-2025-6017 Rhacm: users with clusterreader role can see credentials from managed-clusters

A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4. This vulnerability allows an unprivileged user to view confidential managed cluster credentials through the UI. This information should only be accessible to...

PT-2025-27617 · WordPress · All-In-One Addons For Elementor – Widgetkit

Name of the Vulnerable Software and Affected Versions: All-in-One Addons for Elementor – WidgetKit plugin for WordPress versions up to, and including, 2.5.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'button+modal' widget due to insufficient input sanitizati...

PT-2025-27596 · WordPress · Magic Buttons For Elementor

Name of the Vulnerable Software and Affected Versions: Magic Buttons for Elementor plugin for WordPress versions prior to 1.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin's...

CVE-2025-53391

The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt6.2.0-1 package has insecure PolicyKit allowany/allowinactive/allowactive settings that allow a local user to escalate their privileges to root...

CVE-2025-3771

A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious entry to the registry under the...

CVE-2025-48497

Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered...

CVE-2025-6290

The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

filebrowser Sets Insecure File Permissions

Summary The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers where the umask configuration has not been hardened before, this makes all the stated fil...

CVE-2025-52904 File Browser: Command Execution not Limited to Scope

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The...

CVE-2025-3773

A sensitive information exposure vulnerability in System Information Reporter SIR 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stored in a registry backup folder...

CVE-2025-48497

CVE-2025-48497 affects iroha Board versions v0.10.12 and earlier. A Cross-site request forgery (CSRF) can occur when a logged-in user visits a specially crafted URL, allowing registration of arbitrary learning histories. The issue is documented across multiple sources (NVD/Red Hat/JVN/CNNVD) with...

CVE-2025-48462

Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby preventing legitimate users from gaining access to the product...

CVE-2025-5540

The Event RSVP and Simple Event Management Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

PT-2025-26919 · WordPress · Owl Carousel

Name of the Vulnerable Software and Affected Versions: Owl carousel responsive plugin for WordPress versions up to, and including, 1.9 Description: The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of...

CVE-2025-52969

ClickHouse 25.7.1.557 allows low-privileged users to execute shell commands by querying existing Executable tables created by higher-privileged users. Although the CREATE TABLE privilege is restricted, there is no access control preventing low-privileged users from invoking Executable tables...

Gogs allows deletion of internal files which leads to remote command execution

Summary Due to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the .git directory and achieve remote command execution. Details In the patch for CVE-2024-39931, the following check is added:...

Hitachi Energy MSM

SUMMARY Hitachi Energy is aware of the vulnerability CVE-2020-11022 that affects MSM versions as listed below. If an attacker successfully exploits this vulnerability, it could impact the confidentiality, integrity or availability of MSM. Please consult the Recommended Immediate Actions Section...

CVE-2024-56731

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instanc...