PT-2025-15049 · WordPress · Read More & Accordion

Name of the Vulnerable Software and Affected Versions: Read More & Accordion plugin for WordPress versions up to, and including, 3.4.5 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the addNewButtons function. This allows...

CVE-2025-31477

The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the system. The open endpoint of this plugin is designed to allow open functionality with the system opener e.g. xdg-open on Linux. This was...

CVE-2025-3099

The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due to missing or incorrect nonce validation on the 'MySolrServerSettings' page. This makes it possible for unauthenticated attackers to upda...

Mitel MiCollab <= 9.8 SP2 (9.8.2.12) Multiple Vulnerabilities (MISA-2024-0029)

According to its self-reported version, the instance of Mitel MiCollab running on the remote web server is prior to 9.8 SP2 9.8.2.12 and is, therefore, affected by multiple vulnerabilities: - A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2...

PT-2025-14862 · WordPress · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core plugin for WordPress versions up to and including 5.4.21 Description: The issue is due to missing or incorrect nonce validation on the woffice handle user approval actions function, making it possible for unauthenticated attacker...

CVE-2025-31489 MinIO performs incomplete signature validation for unsigned-trailer uploads

MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. The signature component of the authorization may be invalid, which would mean that as a client you can use any arbitrary secret to upload objects given the user already has prior WRITE permissions on...

BIT-JOOMLA-2023-23754 [20230501] - Core - Open Redirect and XSS within the mfa select

An issue was discovered in Joomla! 4.2.0 through 4.3.1. Lack of input validation caused an open redirect and XSS issue within the new mfa selection screen...

BIT-JOOMLA-2020-24598

An issue was discovered in Joomla! before 3.9.21. Lack of input validation in the vote feature of comcontent leads to an open redirect...

BIT-JOOMLA-2020-13762

In Joomla! before 3.9.19, incorrect input validation of the module tag option in commodules allows XSS...

BIT-JOOMLA-2020-13761

In Joomla! before 3.9.19, lack of input validation in the heading tag option of the "Articles - Newsflash" and "Articles - Categories" modules allows XSS...

BIT-DOLIBARR-2023-4197 Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

Improper input validation in Dolibarr ERP CRM = v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code...

CVE-2025-30471

A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may be able to cause a denial-of-service...

CVE-2025-30452

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An input validation issue was addressed...

CVE-2025-30080

Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service software abort...

CVE-2025-3097

The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the 'wpTimeMachineCore.php' page. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-3099

The CVE-2025-3099 entry concerns the Advanced Search by My Solr Server WordPress plugin. It is described as vulnerable to Cross-Site Request Forgery in all versions up to 2.0.5 due to missing or incorrect nonce validation on the MySolrServerSettings page. The impact stated is that unauthenticated...

Next.js 信息泄露漏洞

Next.js is a React framework open-sourced by Vercel. An information disclosure vulnerability exists in Next.js, which stems from insufficient validation of the x-middleware-subrequest-id, which could lead to information disclosure. The following versions are affected: versions prior to 12.3.6,...

CVE-2025-21964

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies...

AZL-60282 CVE-2025-21963 affecting package kernel for versions less than 6.6.85.1-2

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffies...

CVE-2025-21962 cifs: Fix integer overflow while processing closetimeo mount option

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the value is converted from seconds to jiffi...