AZL-59740 CVE-2025-32414 affecting package libxml2 for versions less than 2.11.5-5

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters...

CVE-2025-32414

In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API Python bindings because of an incorrect return value. This occurs in xmlPythonFileRead and xmlPythonFileReadRaw because of a difference between bytes and characters...

Amazon Linux 2 : python3 (ALAS-2025-2817)

The version of python3 installed on the remote host is prior to 3.7.16-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2817 advisory. A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment we...

FreeBSD : Mozilla -- Memory corruption bug (1205eccf-116d-11f0-8b2c-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1205eccf-116d-11f0-8b2c-b42e991fc52e advisory. [email protected] reports: Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR...

BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

Summary A Remote Code Execution RCE vulnerability caused by insecure deserialization has been identified in the latest versionv1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. Details It exists an unsafe code segment in serde.py: Python def...

CVE-2025-32248

Technical details for CVE-2025-32248 are not provided in the connected documents; no root-cause, affected components, exploit data, or fixes are included. Monitor for updates.

CVE-2025-32192

CVE-2025-32192 is a Stored XSS in Ultra Addons Lite for Elementor (Improper input neutralization during web page generation). Affected: Ultra Addons Lite for Elementor up to version 1.1.8 (root cause: insufficient sanitization of user-controlled input in web page rendering). In the connected Word...

WordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Peter Thaleikis in WordPress Plugin Ai Image Alt Text Generator for WP versions = 1.1.9...

CVE-2025-2797 Woffice Core <= 5.4.21 - Cross-Site Request Forgery to User Registration Approval

The Woffice Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.4.21. This is due to missing or incorrect nonce validation on the 'wofficehandleuserapprovalactions' function. This makes it possible for unauthenticated attackers to approve...

FreeBSD : mozilla -- 64 bit JIT WASM read on left over memroy (a93a1d2a-109d-11f0-8195-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a93a1d2a-109d-11f0-8195-b42e991fc52e advisory. [email protected] reports: On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pic...

WordPress Booster for WooCommerce plugin 4.0.1-7.2.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by luckybuddy in WordPress Plugin Booster for WooCommerce versions 4.0.1-7.2.4...

CVE-2025-32054

In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file...

BIT-JOOMLA-2021-26038 [20210704] - Core - Privilege escalation through com_installer

An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in cominstaller lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for cominstaller is limited to super users already...

BIT-JOOMLA-2020-10240

An issue was discovered in Joomla! before 3.9.16. Missing length checks in the user table can lead to the creation of users with duplicate usernames and/or email addresses...

CVE-2025-31789 WordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Matat Technologies TextMe SMS textme-sms-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TextMe SMS: from n/a through = 1.9.1...

CVE-2025-30915 WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in enituretechnology Small Package Quotes – Worldwide Express Edition small-package-quotes-wwe-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Worldwide Express Edition: from n/a through ...

CVE-2025-2055 MapPress Maps for WordPress < 2.94.9 - Contributor+ Stored XSS

The MapPress Maps for WordPress plugin before 2.94.9 does not sanitise and escape some parameters when outputing them in the page, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...

CVE-2025-22929

OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filterid parameter at /students/StudentFilters.php...

CVE-2025-31690

Cross-Site Request Forgery CSRF vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1.2.1...

CVE-2025-3057

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...