Drupal AI (Artificial Intelligence) module < 1.0.5 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability discovered by Drew Webber mcdruid in WordPress Module AI Artificial Intelligence versions 1.0.5...

CVE-2025-27426

Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL This vulnerability affects Firefox for iOS 136...

AZL-57485 CVE-2025-22869 affecting package terraform for versions less than 1.3.2-24

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted...

Drupal OAuth2 Server module < 2.1.0 - Unauthenticated Broken Access Control vulnerability

Unauthenticated Broken Access Control vulnerability discovered by Pierre Rudloff prudloff in WordPress Module OAuth2 Server versions 2.1.0...

Drupal Cache Utility module < 1.2.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Cache Utility versions 1.2.1...

AZL-57479 CVE-2025-26597 affecting package xorg-x11-server for versions less than 1.20.10-15

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...

AZL-57378 CVE-2025-26595 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-1

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size...

Google Chrome < 133.0.6943.141 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 133.0.6943.141. It is, therefore, affected by a vulnerability as referenced in the 202502stable-channel-update-for-desktop25 advisory. Note that Nessus has not tested for this issue but has instead relied only on the...

WordPress Carousel, Slider, Gallery by WP Carousel plugin < 2.7.4 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Carousel, Slider, Gallery by WP Carousel versions 2.7.4...

firefox: thunderbird: Certificate length was not properly checked

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Certificate length was not properly checked when added to a certificate store. In practice only trusted data was processed...

Drupal Configuration Split module < 1.10.0,2.0.0-2.0.1 - Unauthenticated Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF vulnerability discovered by Eric Smith ericgsmith in WordPress Module Configuration Split versions 1.10.0,2.0.0-2.0.1...

CVE-2025-24812

A vulnerability has been identified in SIMATIC S7-1200 CPU 1211C AC/DC/Rly 6ES7211-1BE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/DC 6ES7211-1AE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1211C DC/DC/Rly 6ES7211-1HE40-0XB0 All versions V4.7, SIMATIC S7-1200 CPU 1212C AC/DC/Rly...

AZL-56758 CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2

A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate,...

CVE-2022-2218

Cross-site Scripting XSS - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0...

WordPress WP All Import Pro plugin < 4.9.8 - Authenticated (Administrator+) PHP Object Injection via Import File vulnerability

Authenticated Administrator+ PHP Object Injection via Import File vulnerability discovered by ? in WordPress Plugin WP All Import Pro versions 4.9.8...

AZL-56204 CVE-2024-10603 affecting package podman for versions less than 5.6.1-2

Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in some circumstances...

CVE-2025-0695

An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input...

Drupal AI (Artificial Intelligence) module < 1.0.3 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Mingsong in WordPress Module AI Artificial Intelligence versions 1.0.3...

CVE-2024-54730

Flatnotes v5.3.1 is vulnerable to denial of service through the upload image function...

AZL-55676 CVE-2024-12088 affecting package rsync for versions less than 3.4.1-1

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...