CVE-2025-4647 A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon web allows Reflected XSS. A user with elevated privileges can bypass sanitization measures by replacing the content of an existing SVG. This issue affects web: from 24.10.0 before...

CVE-2025-4396 Relevanssi <= 4.24.4 (Free) and <= 2.27.4 (Premium) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

Amazon Linux 2 : tomcat (ALASTOMCAT9-2025-017)

The version of tomcat installed on the remote host is prior to 9.0.102-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2TOMCAT9-2025-017 advisory. Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers...

FreeBSD : Mozilla -- javescript content execution (9c37a02e-2e85-11f0-a989-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9c37a02e-2e85-11f0-a989-b42e991fc52e advisory. [email protected] reports: A process isolation vulnerability in Thunderbird stemmed from improper...

CVE-2025-3506

Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and...

CVE-2025-1278 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 12.0 before 17.9.8, 17.10 before 17.10.6, and 17.11 before 17.11.2. Under certain conditions users could bypass IP access restrictions and view sensitive information...

CVE-2025-47501

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Daniel Iser Content Control content-control allows DOM-Based XSS.This issue affects Content Control: from n/a through = 2.6.1...

WordPress WPBookit plugin <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover vulnerability

Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin WPBookit versions = 1.0.2...

CVE-2024-13793

CVE-2024-13793 affects Wolmart – Multi-Vendor Marketplace WooCommerce Theme for WordPress (versions

Django 4.x < 4.2.21, 5.0.x < 5.1.9, 5.2.x < 5.2.1 DoS Vulnerability - Windows

Django is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; ...

WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin <= 1.4.4 - Server Side Request Forgery (SSRF) Vulnerability

WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin = 1.4.4 - Server Side Request Forgery SSRF Vulnerability discovered by HLog in WordPress Plugin Wbcom Designs - Activity Link Preview For BuddyPress versions = 1.4.4...

WordPress Better Search plugin <= 4.1.0 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Better Search versions = 4.1.0...

CVE-2025-46573 passport-wsfed-saml2 Has SAML Authentication Bypass via Attribute Smuggling

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done b...

CVE-2025-29481 affecting package libbpf for versions less than 1.2.2-2

CVE-2025-29481 affecting package libbpf for versions less than 1.2.2-2. A patched version of the package is available...

CVE-2025-21814 affecting package kernel for versions less than 5.15.179.1-1

CVE-2025-21814 affecting package kernel for versions less than 5.15.179.1-1. A patched version of the package is available...

Docker Desktop < 4.41.0 Information Disclosure Vulnerability

The version of Docker Desktop for Linux is prior to 4.41.0. It is therefore affected by an information disclosure vulnerability. The Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive...

CVE-2024-58134

CVE-2024-58134 (Mojolicious on Perl): Affected versions are Mojolicious 0.999922 and later up to 9.39, where the HMAC session cookie secret is derived from a hard-coded string or the app class name by default. This predictable secret enables an attacker who learns or guesses the secret to forge v...

WordPress Nautic Pages plugin <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Nautic Pages versions = 2.0...

CVE-2025-46557

Summary: CVE-2025-46557 affects XWiki platforms from multiple lines of release streams (15.3-rc-1 up to before 15.10.14; 16.0.0-rc-1 up to before 16.4.6; 16.5.0-rc-1 up to before 16.10.0-rc-1). A user who can view pages in the XWiki space can access XWiki.Authentication.Administration and, unless...

CVE-2025-4091

Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firef...