GHSA-FV2R-R8MP-PG48 Soft Serve does not sanitize ANSI escape sequences in user input

Impact In several places where the user can insert data e.g. names, ANSI escape sequences are not being removed, which can then be used, for example, to show fake alerts. In the same token, git messages, when printed, are also not being sanitized. Places in which this was found: 1. Repository...

CVE-2025-12677

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

CVE-2025-12677

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

CVE-2025-12677 KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

CVE-2025-12677 KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure

The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the registerapiroute function in kiotvietsync/includes/publicactions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhoo...

CVE-2025-12677

The KiotViet Sync WordPress plugin (versions up to and including 1.8.5) is vulnerable to Sensitive Information Exposure through register_api_route() in kiotvietsync/includes/public_actions/WebHookAction.php. Unauthenticated attackers can extract the webhook token value when configured. Public rep...

PT-2025-45095

Name of the Vulnerable Software and Affected Versions KiotViet Sync plugin for WordPress versions up to and including 1.8.5 Description The KiotViet Sync plugin for WordPress is susceptible to exposure of sensitive information. Specifically, unauthenticated attackers can extract the webhook token...

WordPress plugin KiotViet Sync 信息泄露漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. An information disclosure vulnerability exists in the WordPress plugin KiotViet Sync, which ste...

CVE-2025-58189 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-447V-2QG4-H8HC vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-61724 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-RJCG-56PH-3QVG vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-61725 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-JWMF-CHVC-RF92 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-QH38-484V-W52X vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-47912 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...

CVE-2025-58186 vulnerabilities

Vulnerabilities for packages: chisel, jitsucom-bulker, checksec, cert-manager, gostatsd, kube-vip-cloud-provider, incert, kube-rbac-proxy, licenseclassifier, mockery, prometheus-alertmanager, redka, mkcert, redpanda, speedtest-go, telegraf, wazero, k6, kwok, falcoctl, stakater-reloader,...