PT-2024-28283 · Open Robotics · Ros2 +1

Name of the Vulnerable Software and Affected Versions: Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions Description: The issue is related to a use-after-free vulnerability via the nav2 amcl process. This vulnerability is triggered by remotely sending a request to change the...

WordPress plugin Futurio Extra has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-37863

Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions were discovered to contain a buffer overflow via the nav2amcl process. This vulnerability is triggered via sending a crafted .yaml file...

WordPress ABCBiz Addons and Templates for Elementor plugin <= 2.0.2 - Stored Cross Site Scripting (XSS) vulnerability

Stored Cross Site Scripting XSS vulnerability discovered by Gab Patchstack Alliance in WordPress Plugin ABCBiz Addons and Templates for Elementor versions = 2.0.2...

WordPress Advanced Control Manager plugin <= 2.16.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Advanced Control Manager for WordPress by ItalyStrap versions = 2.16.0...

Nav2 security vulnerabilities

Nav2 is the ROS community's navigation framework and system for ROS2. A security vulnerability exists in Nav2, which stems from a buffer overflow vulnerability. A local attacker exploiting this vulnerability could execute arbitrary code via the nav2amcl process...

PT-2025-39414

Name of the Vulnerable Software and Affected Versions TensorFlow version 2.18.0 Description TensorFlow version 2.18.0 exhibits a behavior where it outputs random results during the compilation of the Embedding component. This can lead to unpredictable application behavior. Recommendations At the...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...

WordPress Authors List plugin <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax vulnerability

Unauthenticated Arbitrary Shortcode Execution via updateauthorslistajax vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Authors List versions = 2.0.4...

WordPress NPS computy plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin NPS computy versions = 2.8.0...

Mochi MQTT security vulnerability

Mochi MQTT is a fully compatible, embeddable, high-performance Go MQTT v5 proxy/server from the Mochi MQTT open source. A security vulnerability exists in Mochi MQTT version v2.6.3, which stems from a vulnerability that allows an attacker to trigger a denial of service DoS via a crafted request...

PT-2024-35296 · Unknown · Awesome Studio

Name of the Vulnerable Software and Affected Versions: Awesome Studio versions prior to 2.4.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to inject malicious scripts...

SUSE CVE-2024-53859

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

WordPress Out Of Stock Badge plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by SOPROBRO in WordPress Plugin Out Of Stock Badge versions = 2.0...

WordPress WooCommerce Ultimate Gift Card plugin < 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin WooCommerce Ultimate Gift Card versions 2.9.1...

WordPress Image Alt Text plugin <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Image Alt Text Update vulnerability

Missing Authorization to Authenticated Subscriber+ Image Alt Text Update vulnerability discovered by WordFence in WordPress Plugin Image Alt Text versions = 2.0.0...

PT-2024-16627 · WordPress · The Counter Up – Animated Number Counter & Milestone Showcase

Name of the Vulnerable Software and Affected Versions: The Counter Up – Animated Number Counter & Milestone Showcase plugin for WordPress versions up to, and including, 2.4.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'lgx-counter' shortcode due to...

WordPress Counter Up plugin <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Counter Up versions = 2.4.0...

CVE-2024-52008 Password Policy Bypass Vulnerability in Fides Webserver

Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API cal...

WordPress plugin Spotify Play Button has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...