CVE-2025-1306

The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect nonce validation on the newscrunchinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-23240

in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios...

Mozilla Thunderbird < 128.8

The version of Thunderbird installed on the remote Windows host is prior to 128.8. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2025-18 advisory. - Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of thes...

CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2

CVE-2024-12133 affecting package libtasn1 for versions less than 4.19.0-2. A patched version of the package is available...

CVE-2025-27094

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the size attribute...

CVE-2025-23521

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GoodLayers Goodlayers Blocks goodlayers-blocks allows Reflected XSS.This issue affects Goodlayers Blocks: from n/a through = 1.0.1...

CVE-2025-23564 WordPress WP FixTag plugin <= v2.0.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mohsenshahbazi WP FixTag allows Reflected XSS. This issue affects WP FixTag: from n/a through v2.0.2...

SUSE CVE-2025-27154

Spotipy is a lightweight Python library for the Spotify Web API. The CacheHandler class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has rw-r--r-- 644 permissions by default, when it could be locked down to rw------- 600 permissions. This leads to overly...

PT-2025-9049 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP5 IBM Cognos Analytics versions 12.0.0 through 12.0.4 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially crafted URL request...

CVE-2025-25761

HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php...

CVE-2020-10722 affecting package ceph for versions less than 18.2.2-1

CVE-2020-10722 affecting package ceph for versions less than 18.2.2-1. A patched version of the package is available...

CVE-2025-25513

Seacms =13.3 is vulnerable to SQL Injection in adminmembers.php...

CVE-2025-26877 WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through = 3.2.30...

CVE-2025-25520

CVE-2025-25520 affects SeaCMS, specifically version 13.3, with a vulnerability in admin_pay.php that allows SQL injection. The available sources describe the vulnerable component and the underlying issue as an SQL injection in that PHP file; no explicit exploitation details or patch/version to re...

CVE-2025-27112

Navidrome ≤0.54.5 is vulnerable to an authentication bypass in certain Subsonic API endpoints. A flaw in the authentication check allows an attacker to specify any non-existent username together with a salted hash of an empty password, making the request appear authenticated and granting read-onl...

CVE-2025-27349 WordPress Get Posts plugin <= 0.6 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in nurelm Get Posts nurelm-get-posts allows Stored XSS.This issue affects Get Posts: from n/a through = 0.6...

CVE-2025-20051 Arbitrary file read via block duplication in Mattermost Boards

Mattermost versions 10.4.x = 10.4.1, 9.11.x = 9.11.7, 10.3.x = 10.3.2, 10.2.x = 10.2.2 fail to properly validate input when patching and duplicating a board, which allows a user to read any arbitrary file on the system via duplicating a specially crafted block in Boards...

NovaCHRON Zeitsysteme Smart Time Plus 安全漏洞

NovaCHRON Zeitsysteme Smart Time Plus is a time management only program from NovaCHRON Zeitsysteme. A security vulnerability exists in NovaCHRON Zeitsysteme Smart Time Plus versions prior to v8.x through v8.6, which stems from an improper access control vulnerability in the...

ClickHouse < 1.1.54131

The version of ClickHouse installed on the remote host is prior to 1.1.54131. It is, therefore, affected by an access control vulnerability. An Incorrect configuration in deb package in ClickHouse before 1.1.54131 could lead to unauthorized use of the database. Note that Nessus has not tested for...

tarteaucitron Cross-site Scripting (XSS)

Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting XSS via the getElemWidth and getElemHeight. This is related to SNYK-JS-TARTEAUCITRONJS-8366541...