CVE-2025-69095 WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through = 1.7...

CVE-2025-69049

CVE-2025-69049 is a Local File Inclusion vulnerability in the WordPress theme Töbel by Elated-Themes, described as Improper Control of Filename for Include/Require Statement ('PHP Remote File Inclusion') that permits PHP Local File Inclusion. Public records (NVD/Red Hat/CVE lists) attribute the i...

CVE-2025-67626 WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through = 1.1...

CVE-2025-66960

A flaw was found in ollama. A remote attacker can exploit this vulnerability by providing untrusted GGUF GGML Unified Format metadata with a specially crafted string length. This can cause the readGGUFV1String function to improperly process the input, leading to a denial of service, which makes t...

CVE-2026-24038

Horilla HRMS has a 2FA bypass in version 1.4.0 due to a flawed OTP equality check: when OTP expires, the server returns None and omitting the otp field makes user_otp == otp pass, bypassing 2FA. Administrative accounts risk data compromise; fixed in version 1.5.0. Remediation: upgrade to 1.5.0 or...

PT-2026-4213

Cross-Site Request Forgery CSRF vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Cross Site Request Forgery.This issue affects PawFriends - Pet Shop and Veterinary WordPress Theme: from n/a through = 1.3...

WordPress Plugin Depot security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

WordPress plugin Holmes security vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

PT-2026-4298

Name of the Vulnerable Software and Affected Versions Rekor versions 1.4.3 and below Description Rekor is a software supply chain transparency log. A Server-Side Request Forgery SSRF exists in versions 1.4.3 and below due to the /api/v1/index/retrieve endpoint supporting retrieval of a public key...

PT-2026-4019

Name of the Vulnerable Software and Affected Versions Angel Costa WP SEO Search versions through 1.1 Description The software contains a Cross-Site Request Forgery CSRF flaw. This allows attackers to potentially perform actions on behalf of authenticated users without their knowledge...

PT-2026-3912

Horilla is a free and open source Human Resource Management System HRMS. Versions 1.4.0 and above expose unpublished job postings through the /recruitment/recruitment-details// endpoint without authentication. The response includes draft job titles, descriptions and application link allowing...

WordPress Plugin “Wordpress Movies Bulk Importer” has security vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...

WordPress plugin SearchAzon has a cross-site request forgeing vulnerability.

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-3913

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.5.0 Description Horilla is a Human Resource Management System HRMS. The has xss function in version 1.4.0 attempts to prevent Cross-Site Scripting XSS by using regular expressions to filter input. However, these...

CVE-2026-23737

CVE-2026-23737 affects the seroval JavaScript library. The flaw resides in the JSON deserialization path, specifically the fromJSON and fromCrossJSON functions, where improper input handling can permit arbitrary JavaScript code execution. Exploitation is described as requiring multiple (four) req...

CVE-2021-47865

ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly establish connections using threading to exhaust server connection limits and block legitimate user access...

CVE-2025-41025

Stored Cross-Site Scripting XSS in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between parameters and assigned identifiers is as follows: 'category' y 'product' parameters in '/farm/sellproduct.php'...

CVE-2025-41025

CVE-2025-41025 : A stored Cross-Site Scripting (XSS) vulnerability affects Poultry Farm Management System v1.0. The issue arises from insufficient input validation on POST requests to the endpoint: /farm/sell_product.php, specifically affecting the parameters category and product . The root cause...

MiracleLinux 8 : libreswan-4.12-2.el8_10.4 (AXSA:2024-8551:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2024-8551:06 advisory. libreswan: IKEv1 default AH/ESP responder can crash and restart CVE-2024-3652 Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : kernel-3.10.0-1160.66.1.el7 (AXSA:2022-3196:08)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3196:08 advisory. kernel: cgroups v1 releaseagent feature may allow privilege escalation CVE-2022-0492 Tenable has extracted the preceding description block directly from the...