PT-2025-36179

Name of the Vulnerable Software and Affected Versions Ibnul H. Custom Team Manager versions through 2.4.2 Description The software contains an Improper Neutralization of Input During Web Page Generation vulnerability, which allows for Stored Cross-site Scripting XSS. Recommendations Update Ibnul ...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

CVE-2025-58359 frost-core: refresh shares with smaller min_signers will reduce group security

ZF FROST is a Rust implementation of FROST Flexible Round-Optimised Schnorr Threshold signatures. In versions 2.0.0 through 2.1.0, refresh shares with smaller minsigners will reduce security of group. The inability to change minsigners i.e. the threshold with the refresh share functionality...

WordPress Lagom theme <= 2.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Lagom versions = 2.0...

WordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Knowledge Base versions = 2.9...

Cri-o: pods are able to break out of resource confinement on cgroupv2

...

Linux Distros Unpatched Vulnerability : CVE-2018-1000098

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be...

CVE-2025-57576

PHPGurukul Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting XSS in /admin/updateorder.php...

GHSA-WGQ8-VR6R-MQXM frost-core: refresh shares with smaller min_signers will reduce security of group

Impact It was not clear that it is not possible to change minsigners i.e. the threshold with the refresh share functionality frostcore::keys::refresh module. Using a smaller value would not decrease the threshold, and attempts to sign using a smaller threshold would fail. Additionally, after...

An issue was discovered in NASM version 2.16rc0. There are memory leaks in nasm_malloc() in nasmlib/alloc.c.

...

CVE-2025-58632 WordPress Dadevarzan WordPress Common Plugin <= 2.2.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dadevarzan Dadevarzan WordPress Common dadevarzan-common allows Stored XSS.This issue affects Dadevarzan WordPress Common: from n/a through = 2.2.2...

WordPress Sticky Side Buttons plugin < 2.0.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Sayandeep Dutta in WordPress Plugin Sticky Side Buttons versions 2.0.0...

WordPress plugin Sticky Side Buttons has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2025-57151

phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting XSS in admin/userprofile.php via the fullname parameter...

Linux Distros Unpatched Vulnerability : CVE-2017-7491

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the number of courses displayed in the course overview block configuration...

Allocation of Resources Without Limits or Throttling (MadeYouReset)

Overview io.undertow:undertow-core is a Java web server based on non-blocking IO. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling MadeYouReset through malformed client requests that trigger repeated server-side stream resets without...

Copeland E3 Supervisory Control Security Vulnerabilities

Copeland E3 Supervisory Control is an industrial equipment control system from Copeland, USA. A security vulnerability exists in Copeland E3 Supervisory Control versions prior to 2.31F01 that stems from a predictable default user ONEDAY password...

batteryKid security vulnerabilities

batteryKid is a tool to extend battery life by the individual developer of Alaneuler. A security vulnerability exists in batteryKid 2.1 and earlier versions, which stems from a missing authentication in the file PrivilegeHelper/PrivilegeHelper.swift...

MAL-2025-46954 Malicious code in monolith-twirp-octoshift-imports (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 221b3fbda6780c082532d35d4b0ce79ea245c161c259ec2d4e3f741df68efe52 The OpenSSF Package Analysis project identified 'monolith-twirp-octoshift-imports' @ 2.7.1 rubygems as malicious. It is considered malicious...