WordPress plugin: Vulnerability in cross-site request forgeing in Easy Property Listings

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is ...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an improper setting of pagelen in the NFSv2 GETACL result encoder, which could lead to a memory content leak...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2025-992555)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992555 advisory. In the Linux kernel, the following vulnerability has been resolved: sched, cpuset: Fix dlcpubusy panic due to empty cs-cpusallowed With cgroup v2, the cpuset's...

CVE-2025-53627 Meshtastic firmware allows forged DMs with no PKC to show up as encrypted

Meshtastic is an open source mesh networking solution. The Meshtastic firmware starting from version 2.5 introduces asymmetric encryption PKI for direct messages, but when the pkiencrypted flag is missing, the firmware silently falls back to legacy AES-256-CTR channel encryption. This was an...

Security update for apache2-mod_auth_openidc

This update for apache2-modauthopenidc fixes the following issues: Update to 2.4.17.1 bsc1248806 / PED-14130. Remove many patches, as they've been merged upstream. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch...

CVE-2025-68697

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

CVE-2025-68668

n8n is an open source workflow automation platform. From version 1.0.0 to before 2.0.0, a sandbox bypass vulnerability exists in the Python Code Node that uses Pyodide. An authenticated user with permission to create or modify workflows can exploit this vulnerability to execute arbitrary commands...

GNU BinUtils security vulnerabilities

GNU BinUtils is a collection of programming tools for working with binary files from the US GNU community. A security vulnerability exists in GNU BinUtils version 2.26, which stems from the improper handling of specially crafted PE files by the dprintcompinner function in the cp-demangle.c file,...

PT-2025-53786

Name of the Vulnerable Software and Affected Versions TP-Link TL-WR820N version 2.80 Description A weakness in the SSH server implementation of the device permits the use of a weak cryptographic algorithm. This allows a nearby attacker to potentially intercept and decrypt SSH traffic, which could...

Jsish security vulnerabilities

Jsish is a small JavaScript parser written in C with a built-in database by the pcmacdon individual developer. A security vulnerability exists in Jsish version 2.0 that stems from type confusion and could lead to a crash or code execution...

D-Link DIR-600 security vulnerabilities

The D-Link DIR-600 is a wireless router from China AUO D-Link. A security vulnerability exists in the D-Link DIR-600 version 2.15WWb02 and prior versions, which stems from the incorrect manipulation of the parameter Cookie in the file hedwig.cgi of the component HTTP Header Handler, which could...

PLC NLcon-CE-485-C Codesys v2 Failure

The vulnerability of PLC NLcon-CE-485-C is related to insufficient validation of input data in the Codesys v2 service. Exploiting this vulnerability can allow an attacker, operating remotely, to cause failures in the Codesys v2 execution environment...

PLC NLcon-CE-485-C Codesys v2 Failure

The vulnerability of PLC NLcon-CE-485-C is related to insufficient validation of input data during the processing of the 0xbbbb packet in Codesys v2. Exploiting this vulnerability can allow an attacker to cause a failure in the operation of the Codesys v2 execution environment...

CVE-2025-15141

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high...

Fedora 42 : tkimg (2025-419c60783f)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-419c60783f advisory. Update to 2.1.0. Update bundled libpng, libtiff, to latest versions. Built against TCL/TK 9. Fix FTBFS. Tenable has extracted the preceding...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

CVE-2025-68697 Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

n8n is an open source workflow automation platform. Prior to version 2.0.0, in self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node...

Trust Wallet Chrome Extension Breach Caused $7 Million Crypto Loss via Malicious Code

Trust Wallet is urging users to update its Google Chrome extension to the latest version following what it described as a "security incident" that led to the loss of approximately $7 million. The issue, the multi‑chain, non‑custodial cryptocurrency wallet service said, impacts version 2.68. The...

CVE-2025-2307

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Verisay Communication and Information Technology Industry and Trade Ltd. Co. Aidango allows Cross-Site Scripting XSS.This issue affects Aidango: before 2.144.4...

CVE-2024-44065

A time-based blind SQL injection vulnerability exists in Cloudlog v2.6.15 , a self-hosted PHP application used for logging amateur radio contacts. The flaw is located at the /index.php/logbookadvanced/search endpoint within the qsoresults parameter. This vulnerability allows an attacker to execut...