ABB AC500 V2 security vulnerabilities

ABB AC500 V2 is a PLC from ABB Switzerland. suitable for simple control tasks and complex automation solutions. A security vulnerability exists in ABB AC500 V2 version 2.5.2 and earlier, which stems from vulnerability to buffer over-reading attacks...

Harbor cross-site scripting vulnerabilities

Harbor is an open source registry from Harbor Open Source. Protects artifacts with policies and role-based access control, ensures images are scanned and free of vulnerabilities, and signs images as trusted. A cross-site scripting vulnerability exists in Harbor versions 2.11.2 and earlier,...

SUSE-SU-2025:02423-1 Security update for kubernetes1.23

This update for kubernetes1.23 fixes the following issues: - CVE-2021-25743: Escape terminal special characters in kubectl output bsc1194400. - CVE-2023-2431: Prevent pods to bypass the seccomp profile enforcement bsc1212493. - CVE-2024-0793: Advance autoscaling v2 as the preferred API version...

Dippy security vulnerabilities

Dippy is an AI chat site from Dippy Inc. A security vulnerability exists in Dippy version v2, which stems from improper access control of the conversationid parameter and could lead to the disclosure of sensitive information...

PT-2025-45275

Name of the Vulnerable Software and Affected Versions Favorites versions prior to 2.3.7 Description An improper control of filename for include/require statements in the Favorites plugin for WordPress allows for Local File Inclusion. This issue enables unauthenticated attackers to include and...

WordPress plugin Avishi WP PayPal Payment Button: Cross-site Request Forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

openjdk: Improve scripting supports (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...

Splashin iOS security vulnerabilities

Splashin iOS is an iOS application by Splashin, Inc. A security vulnerability exists in Splashin iOS version v2.0, which stems from not enforcing server-side interval limits and could lead to location data disclosure...

WordPress plugin Zuppler Online Ordering has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...

Apache HTTP Server: HTTP/2 DoS by Memory Increase

...

tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame

A flaw was found in Apache Tomcat. This vulnerability allows an application-level denial of service DoS, causing it to become unresponsive or slow via maliciously crafted HTTP/2 prioritization headers. It performs an incomplete cleanup of failed requests, which triggers a memory leak...

Security update for rmt-server

This update for rmt-server fixes the following issues: Update to version 2.23 CVE-2025-46727: Fixed Unbounded-Parameter DoS in Rack:QueryParser. bsc1242893 CVE-2025-32441: Fixed a bug where simultaneous rack requests can restore a deleted rack session. bsc1242898 Patch Instructions: To install th...

WordPress plugin Ofiz - WordPress Business Consulting Theme Cross Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress plugin Multi-language Responsive Contact Form has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

Least Privilege Violation Vulnerability in the communications functions of NJ/NX series Machine Automation Controllers

Overview Least privilege violation vulnerability CWE-272 exists in the communication function between the NJ/NX-series Machine Automation Controllers and the Sysmac Studio Software provided by OMRON Corporation. - CVE-2025-1384 OMRON Corporation reported this vulnerability to JPCERT/CC to notify...

WordPress Store Exporter plugin <= 2.7.6 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin Store Exporter versions = 2.7.6...

WordPress WooCommerce Store Toolkit plugin <= 2.4.3 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by LVT-tholv2k in WordPress Plugin WooCommerce Store Toolkit versions = 2.4.3...

CVE-2025-53839 DRACOON Branding Service vulnerable to Cross-site Scripting

DRACOON is a file sharing service, and the DRACOON Branding Service allows customers to customize their DRACOON interface with their brand. Versions of the DRACOON Branding Service prior to 2.10.0 are vulnerable to cross-site scripting. Improper neutralization of input from administrative users...

DRACOON Branding Service Cross-site Scripting Vulnerability

DRACOON Branding Service is a branding customization software from DRACOON Germany. A cross-site scripting vulnerability exists in DRACOON Branding Service versions prior to 2.10.0 that stems from improper input neutralization and could lead to a cross-site scripting attack...

OTRS security vulnerabilities

OTRS is a service management solution from OTRS Germany. A security vulnerability exists in OTRS that stems from an external interface that allows the inference of user account presence, which could lead to the identification of valid email addresses. The following versions are affected: version...