CVE-2025-47933 Argo CD allows cross-site scripting on repositories page

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.13.8, 2.14.13, and 3.0.4, an attacker can perform arbitrary actions on behalf of the victim via the API. Due to the improper filtering of URL protocols in the repository page, an attacker can achieve...

CVE-2025-48748

Netwrix Directory Manager formerly Imanami GroupID through v.10.0.7784.0 has a hard-coded password...

CVE-2025-48749

Netwrix Directory Manager (formerly Imanami GroupID) is affected by CVE-2025-48749. The issue concerns the insertion of sensitive information into sent data. Affected software: Netwrix Directory Manager versions prior to 11.1.25134.03 (per multiple sources); remediation guidance from PT-Security ...

CVE-2025-48747

Netwrix Directory Manager formerly Imanami GroupID before and including v.11.0.0.0 and after v.11.1.25134.03 has Incorrect Permission Assignment for a Critical Resource...

Mautic 安全漏洞

Mautic is an open source marketing automation software from Mautic Open Source. The software monitors and manages websites, sends emails and manages customer resources. A security vulnerability exists in versions prior to Mautic 6.0.2, which stems from a time-difference attack in the Forgot...

CVE-2025-48746

Netwrix Directory Manager (formerly Imanami GroupID) v11.0.0.0 and earlier, and post-v11.1.25134.03, lack authentication for a critical function. Root cause beyond “lack of authentication” is not detailed in the provided sources. CVSSv3.1 base score 6.5 (NETWORK, LOW confidentiality/integrity imp...

CVE-2025-48383

Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and ModelSelect2Widget can leak secret access tokens across requests. This can allow users to access restricted query sets and restricted data...

CVE-2025-5268

CVE-2025-5268 is a memory-safety vulnerability affecting Firefox and Thunderbird. The advisory notes memory-safety bugs in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10, with evidence of memory corruption. It is stated that some bugs could, with enough effort, be exploi...

PT-2025-22969 · Nagvis +1 · Nagvis +1

Name of the Vulnerable Software and Affected Versions: Nagvis versions prior to 1.9.47 Description: The issue is related to the improper neutralization of input in Nagvis, which can lead to livestatus injection. This can potentially allow for unauthorized access or control. Recommendations: For...

Mozilla Thunderbird < 128.11

The version of Thunderbird installed on the remote Windows host is prior to 128.11. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-46 advisory. - Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory...

CVE-2024-52874

In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks...

WordPress Pagelayer plugin <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Button Link vulnerability discovered by zer0gh0st in WordPress Plugin PageLayer versions = 2.0.0...

CVE-2025-48064

GitHub Desktop is an open-source, Electron-based GitHub app designed for git development. Prior to version 3.4.20-beta3, an attacker convincing a user to view a file in a commit of their making in the history view can cause information disclosure by means of Git attempting to access a network...

CVE-2025-32289 WordPress Yozi theme <= 2.0.63 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ApusTheme Yozi yozi allows PHP Local File Inclusion.This issue affects Yozi: from n/a through = 2.0.63...

CVE-2025-21610

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy a malicious javascript: URL as a link that would execute arbitrary...

CVE-2025-24361

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

CVE-2025-21615

AAT Another Activity Tracker is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device...

CVE-2024-4278

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting...

CVE-2024-38870

Zohocorp ManageEngine OpManager, OpManager Plus, OpManager MSP and OpManager Enterprise Edition versions before 128104, from 128151 before 128238, from 128247 before 128250 are vulnerable to Stored XSS vulnerability in reports module...

CVE-2024-4006

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.7 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1 where personal access scopes were not honored by GraphQL subscriptions...