CVE-2025-31681

The CVE-2025-31681 entry covers Drupal Authenticator Login (versions 0.0.0 through 2.0.5) with a Missing Authorization vulnerability that enables Forceful Browsing. Affected component is the Drupal Authenticator Login module; root cause is lack of proper authorization checks when accessing user-p...

CVE-2025-31677 AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003

Cross-Site Request Forgery CSRF vulnerability in Drupal AI Artificial Intelligence allows Cross Site Request Forgery.This issue affects AI Artificial Intelligence: from 1.0.0 before 1.0.2...

CVE-2025-31674 Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

CVE-2025-31598 WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin <= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory Quantity Dynamic Pricing & Bulk Discounts for WooCommerce wholesale-pricing-woocommerce allows Stored XSS.This issue affects Quantity Dynamic Pricing & Bulk Discounts for WooCommerce: fro...

CVE-2025-30784

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through = 1.2.3...

CVE-2025-30787

Cross-Site Request Forgery CSRF vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through = 5.25.08...

CVE-2024-51624 WordPress Já-Já Pagamentos for WooCommerce plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jajapagamentos Já-Já Pagamentos for WooCommerce wc-ja-ja-pagamentos-multicaixa-express allows Reflected XSS.This issue affects Já-Já Pagamentos for WooCommerce: from n/a through = 1.3.0...

CVE-2025-31474

Cross-Site Request Forgery CSRF vulnerability in matthewprice1178 WP Database Optimizer wp-database-optimizer allows Cross Site Request Forgery.This issue affects WP Database Optimizer: from n/a through = 1.2.1.3...

CVE-2025-22783

CVE-2025-22783 affects the WordPress SEO Plugin by Squirrly SEO (versions up to and including 12.4.03). The root cause is improper neutralization of special elements in SQL commands, leading to SQL injection. Public sources in connected docs note that the vulnerability impacts confidentiality, in...

CVE-2025-30867 WordPress SearchIQ plugin <= 4.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through = 4.7...

CVE-2025-2528

Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the system administrators. This issue affects Remote Desktop Manager versions from 2025.1.24 through...

CVE-2025-26544

CVE-2025-26544 affects the WordPress plugin setup for UTM tags tracking in Contact Form 7 (versions

CVE-2025-27552

DBIx::Class::EncodedColumn use the rand function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032...

BIT-CILIUM-2025-30162 East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to...

CVE-2025-28923

Cross-Site Request Forgery CSRF vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through = 2.5.1...

GHSA-9M3Q-RHMV-5Q44 Out-of-bounds Read in Ruby JSON Parser

Impact A specially crafted document could cause an out of bound read, most likely resulting in a crash. Versions 2.10.0 and 2.10.1 are impacted. Older versions are not. Patches Version 2.10.2 fixes the problem. Workarounds None...

CVE-2025-28923

Cross-Site Request Forgery CSRF vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: from n/a through = 2.5.1...

CVE-2025-28902

CVE-2025-28902 is a CSRF vulnerability in the WordPress plugin Contact Form 7 Select Box Editor Button , affecting versions up to 0.6. The connected details confirm a cross-site request forgery flaw in this plugin; no exploitation details or patch/remediation are provided in the sources. The entr...

CVE-2025-28886 WordPress REST API TO MiniProgram plugin <= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through = 5.1.2...

CVE-2025-26695

When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested email address. This vulnerability affects Thunderbird 136 and Thunderbird 128.8...