PT-2025-31271 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: A logic issue existed due to insufficient checks. Processing maliciously crafted web content may lead to an unexpected Safari crash. Recommendations: Update to macOS version 15.6...

FreeBSD : Mozilla -- HTTP Basic Authentication credentials leak (477e9eb3-685e-11f0-a12d-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 477e9eb3-685e-11f0-a12d-b42e991fc52e advisory. [email protected] reports: The username:password part was not correctly stripped from URLs in CSP...

CVE-2023-53156

The CVE-2023-53156 issue affects the Rust crate transpose prior to version 0.2.3 . The vulnerability is an integer overflow triggered by the input_width and input_height arguments in the affected code path. The impact is described as an overflow condition; no exploitation details are provided in ...

CVE-2025-32429

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

CVE-2025-7966

The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subscount’ parameters in all versions up to, and including, 3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2025-32989 affecting package gnutls for versions less than 3.7.11-4

CVE-2025-32989 affecting package gnutls for versions less than 3.7.11-4. A patched version of the package is available...

CVE-2025-7959 Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters

The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-lev...

WordPress Taeggie Feed plugin <= 0.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via name Attribute vulnerability discovered by Gilang in WordPress Plugin Taeggie Feed versions = 0.1.10...

CVE-2025-54377

CVE-2025-54377 affects Roo Code. In versions 3.23.18 and earlier, Roo Code fails to validate line breaks in command input, allowing multi-line command injection by smuggling additional commands beyond the first line during evaluation. The issue stems from missing parsing/validation logic for inpu...

CVE-2025-4439

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed an authenticated user to perform cross-site scripting attacks when the instance is served through certain content delivery networks...

CVE-2025-54141 ViewVC's standalone server exposes arbitrary server filesystem content

ViewVC is a browser interface for CVS and Subversion version control repositories. In versions 1.1.0 through 1.1.31 and 1.2.0 through 1.2.3, the standalone.py script provided in the ViewVC distribution can expose the contents of the host server's filesystem though a directory traversal-style...

CVE-2025-54141

ViewVC’s standalone server (standalone.py) is vulnerable to a directory-traversal style attack that can expose the host filesystem. Affected releases are ViewVC 1.1.0–1.1.31 and 1.2.0–1.2.3; the issue is fixed in 1.1.31 and 1.2.4. Impact is described as exposure of arbitrary filesystem content; n...

CVE-2025-8035

CVE-2025-8035 affects Mozilla Firefox and Thunderbird desktop clients (Firefox/Firefox ESR and Thunderbird up to versions around 140.x/141.x). The connected sources describe memory-safety bugs in Firefox ESR 128.12, 140.0, and Firefox/Thunderbird 140, plus similar issues in Thunderbird ESR lines,...

CVE-2025-7899 Insecure Direct Object Reference in extension "powermail" (powermail)

The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects powermail version 12.0.0 up to 12.5.2 and version 13.0.0...

CVE-2025-52580

Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be exposed to an attacker who has access to the application logs...

Zoom Workplace Desktop App < 6.4.13 Information Disclosure (ZSB-25023)

The version of Zoom Workplace Desktop App installed on the remote host is prior to 6.4.13. It is, therefore, affected by a vulnerability as referenced in the ZSB-25023 advisory. - Improper certificate validation in Zoom Workplace for Linux before version 6.4.13 may allow an unauthorized user to...

CVE-2025-46119

An issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.27 and 200.18.7.1.323, and in Ruckus ZoneDirector prior to 10.5.1.0.282, where an authenticated request to the management endpoint /admin/cmdstat.jsp discloses the administrator password in a trivially reversible obfuscat...

PT-2025-30340 · Romm · Romm

Name of the Vulnerable Software and Affected Versions: RomM versions 4.0.0-beta.3 and below Description: RomM is a tool that allows users to manage their game collections. An authenticated arbitrary file write issue exists in the /api/saves endpoint. This can lead to Remote Code Execution. The...

Netgear RAX30 安全漏洞

The NETGEAR RAX30 is a dual-band wireless router from NETGEAR. A security vulnerability exists in Netgear RAX30 version V1.0.10.94, which can be exploited by an attacker to potentially cause remote code execution...

CVE-2025-6781 Copymatic – AI Content Writer & Generator <= 2.1 - Cross-Site Request Forgery to Settings Update

The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This is due to missing or incorrect nonce validation on the 'copymatic-menu' page. This makes it possible for unauthenticated attackers to upda...