2872 matches found
CVE-2025-64232 WordPress Import from YML plugin <= 3.1.17 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affects Import from YML: from n/a through = 3.1.17...
CVE-2025-62049 WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability
Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through = 3.5.32...
WordPress plugin Smush Image Compression and Optimization 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A security...
[SECURITY] Fedora 43 Update: python-openapi-core-0.19.5-9.fc43
Openapi-core is a Python library that adds client-side and server-side support for the OpenAPI v3.0 and OpenAPI v3.1 specification...
Unity Linux 20.1050e Security Update: kernel (UTSA-2025-989919)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989919 advisory. In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bcserv is NULL When a rdma server returns a fault form...
CVE-2025-64320
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Code Injection.This issue affects Agentforce Vibes Extension: before 3.2.0...
CVE-2025-12400 LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The LMB^Box Smileys plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2. This is due to missing or incorrect nonce validation on the managepage function. This makes it possible for unauthenticated attackers to update settings and inject...
CVE-2025-45663
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a domevent structure...
CVE-2024-51317
An issue in NetSurf v.3.11 allows a remote attacker to execute arbitrary code via the domnodenormalize function...
CVE-2025-45663
An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a domevent structure...
EUVD-2025-37328
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in colabrio Ohio Extra ohio-extra allows DOM-Based XSS.This issue affects Ohio Extra: from n/a through = 3.6.0...
Unity Linux 20.1070e Security Update: ongres-scram (UTSA-2025-988625)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988625 advisory. SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms...
CVE-2025-61429
An issue in NCR Atleos Terminal Manager ConfigApp v3.4.0 allows attackers to escalate privileges via a crafted request...
OpenEXR < 3.4.3 -- multiple vulnerabilities
Cary Phillips reports: Patch release that addresses several bugs, primarily involving properly rejecting corrupt input data. He goes on to report various relevant items including heap buffer overflows, use-after-free, use of uninitialized memory and other bugs, several of them found by OSS-fuzz,...
CVE-2025-62962
Cross-Site Request Forgery CSRF vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through = 3.0.0...
EUVD-2025-36055
Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through = 3.13.0...
CVE-2025-62983
CVE-2025-62983 is a stored XSS in the WordPress plugin Posts By Tag (versions ≤ 3.2.1). The issue arises from improper neutralization of input during web page generation, enabling injection of malicious scripts that could be persisted and reflected to users. The vulnerability is labeled as MEDIUM...
CVE-2025-62979 WordPress ACF to REST API plugin <= 3.3.4 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in airesvsg ACF to REST API acf-to-rest-api allows Retrieve Embedded Sensitive Data.This issue affects ACF to REST API: from n/a through = 3.3.4...
PT-2025-43800
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allows DOM-Based XSS.This issue affects Marquee Addons for Elementor: from n/a through = 3.7.12...
