CVE-2025-3083 Malformed MongoDB wire protocol messages may cause mongos to crash

Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to 6.0.20 and MongoDB v7.0 versions prior to...

CVE-2025-2906

The CVE-2025-2906 entry is tied to Contempo Real Estate Core, a WordPress plugin. It describes a Stored Cross-Site Scripting vulnerability in versions up to 3.6.3 due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. An authenticated attacker with contr...

BIT-GITLAB-2024-12619 Insufficient Granularity of Access Control in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects...

CVE-2025-30882

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in JoomSky JS Help Desk js-support-ticket allows Path Traversal.This issue affects JS Help Desk: from n/a through = 2.9.1...

CVE-2025-31024 WordPress RJ Quickcharts plugin <= 0.6.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in randyjensen RJ Quickcharts rj-quickcharts allows SQL Injection.This issue affects RJ Quickcharts: from n/a through = 0.6.1...

CVE-2025-1534

CVE-2025-1534 affects Payara Server (Payara Platform) with a vulnerability in input handling during web page generation that enables cross-site scripting and remote code inclusion. Affected versions are: Payara Server 4.1.2.1919.1 before 4.1.2.191.51; 5.20.0 before 5.68.0; 6.0.0 before 6.23.0; 6....

Drupal OAuth2 Server Missing Authorization vulnerability

Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing. This issue affects OAuth2 Server: from 0.0.0 before 2.1.0...

GHSA-6CHF-HHQF-749C Drupal OAuth2 Client Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery. This issue affects OAuth2 Client: from 0.0.0 before 4.1.3...

MongoDB -- Unauthorized access to underlying data

[email protected] reports: A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.20, Mongo...

CVE-2025-31686

Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10...

CVE-2025-31688

CVE-2025-31688 is a Cross-Site Request Forgery (CSRF) vulnerability in the Drupal Configuration Split module. The issue affects Configuration Split versions prior to 1.10.0 and prior to 2.0.2 (i.e., 0.0.0–1.9.x and 2.0.0–2.0.1). The root cause is improper CSRF protection on routes that enable/dis...

CVE-2025-31682 Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Google Tag allows Cross-Site Scripting XSS.This issue affects Google Tag: from 0.0.0 before 1.8.0, from 2.0.0 before 2.0.8...

CVE-2024-53259 affecting package coredns for versions less than 1.11.1-15

CVE-2024-53259 affecting package coredns for versions less than 1.11.1-15. A patched version of the package is available...

CVE-2024-44677

eladmin v2.7 and before is vulnerable to Server-Side Request Forgery SSRF which allows an attacker to execute arbitrary code via the DatabaseController.java component...

CVE-2025-31590 WordPress WP Date and Time Shortcode plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Denra.com WP Date and Time Shortcode allows Stored XSS. This issue affects WP Date and Time Shortcode: from n/a through 2.6.7...

CVE-2025-23995 WordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ta2g Tantyyellow allows Reflected XSS.This issue affects Tantyyellow: from n/a through 1.0.0.5...

CVE-2025-2840

The DAP to Autoresponders Email Syncing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0 through the publicly accessible phpinfo.php script. This makes it possible for unauthenticated attackers to view potentially sensitive information...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 : RabbitMQ Server vulnerability (USN-7399-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7399-1 advisory. It was discovered that RabbitMQ Server's management UI did not sanitize certain input. An attacker could possibly use this issue t...

PT-2025-13873 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.5 macOS versions prior to 14.7.5 macOS versions prior to 15.4 Description: A buffer overflow issue was addressed with improved memory handling. This issue may allow an app to cause unexpected system termination or...

CVE-2024-12619

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 before 17.8.6, 17.9 before 17.9.3, and 17.10 before 17.10.1, allowing internal users to gain unauthorized access to internal projects...