CVE-2025-54683: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-modal-popup-with-cookie-integration allows Reflected XSS.This issue affects WP Modal Popup with Cookie Integration: from n/a through = 2.4...

chat-with-mlx (>=0.1.0, <=0.1.11), crewai-files (>=1.9.0, <=1.10.1a1) +9 more potentially affected by CVE-2025-55197 via pypdf (4.0.2)

pypdf PYPI version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chat-with-mlx =0.1.0, =1.9.0, =3.2.0, =1.2.1, =1.0.9, =0.0.0, =0.1.2, =0.73.0, =0.94.0 Source cves: CVE-2025-55197 Source advisory:...

CVE-2025-8907: Execution with Unnecessary Privileges

A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The complexity of an attack is rather hig...

IBM OpenPages Cryptographic Algorithm Unauthorized Access

The vulnerability of IBM OpenPages and IBM OpenPages with Watson risk management platforms lies in the use of cryptographic algorithms that contain vulnerabilities. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

IBM OpenPages Encryption Block Chaining

The vulnerability of IBM OpenPages and IBM OpenPages with Watson risk management platforms relates to the encryption block chaining mode. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

MAL-2025-6824 Malicious code in facebook-for-woocommerce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0ca4dfebc7839330f25a231f2f87af41aef50ea715541751bef46a1709f045e The OpenSSF Package Analysis project identified 'facebook-for-woocommerce' @ 3.6.6 npm as malicious. It is considered malicious because: - The...

PT-2025-48848

Уязвимость микропрограммного обеспечения процессоров Intel Xeon 6 processor with P-cores связана с записью за границами буфера. Эксплуатация уязвимости позволяет нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации...

CVE-2025-8874: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output...

SUSE-SU-2025:02735-1 Security update for python-urllib3

This update for python-urllib3 fixes the following issues: - CVE-2025-50181: Pool managers now properly control redirects when retries is passed. bsc1244925...

Linux Distros Unpatched Vulnerability : CVE-2024-51744

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are...

MAL-2025-6837 Malicious code in faulthandler (npm)

The package communicates with a domain associated with malicious activity...

`xcb::Connection::connect_to_fd*` functions violate I/O safety

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...

PT-2025-34467 · Crates.Io · Xcb

The API of xcb::Connection has constructors which allow an arbitrary RawFd to be used as a socket connection. On either failure of these constructors or on the drop of Connection, it closes the associated file descriptor. Thus, a program which uses an OwnedFd such as a UnixStream as the file...

Malicious code in library-with-exports (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in package-with-conditions (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f084cb6652819e6611585205ff40b4194ebfbedb7d9a43aaaf29f0c4ac8e8828 Any computer that has this package installed or running should be considered...

On One-Shot Signatures, Quantum Vs Classical Binding, and Obfuscating Permutations

One-shot signatures OSS were defined by Amos, Georgiou, Kiayias, and Zhandry STOC'20. These allow for signing exactly one message, after which the signing key self-destructs, preventing a second message from ever being signed. While such an object is impossible classically, Amos et al observe tha...

CVE-2025-54440: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

CVE-2025-5818: Server-Side Request Forgery (SSRF)

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

CVE-2025-7692 Orion Login with SMS <= 1.0.5 - Authentication Bypass via Weak OTP

The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olwshandleverifyphone function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on t...

CVE-2025-7692: Authentication Bypass Using an Alternate Path or Channel

The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olwshandleverifyphone function not utilizing a strong enough OTP value, exposing the hash needed to generate the OTP value, and no restrictions on t...