CVE-2025-26448

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48104

Cross-Site Request Forgery CSRF vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floating Window Music Player: from n/a through = 3.4.2...

CVE-2025-48104

CVE-2025-48104 concerns the Floating Window Music Player WordPress plugin. Public documentation confirms a CSRF vulnerability that leads to Stored XSS in versions up to 3.4.2. Affected software: Floating Window Music Player (WordPress plugin). Root cause: Cross-Site Request Forgery enabling store...

CVE-2025-48104 WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floating Window Music Player: from n/a through = 3.4.2...

CVE-2025-48104 WordPress Floating Window Music Player plugin <= 3.4.2 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in ericzane Floating Window Music Player allows Stored XSS. This issue affects Floating Window Music Player: from n/a through 3.4.2...

PT-2025-36244

Name of the Vulnerable Software and Affected Versions: Floating Window Music Player versions through 3.4.2 Description: A Cross-Site Request Forgery CSRF vulnerability exists in ericzane Floating Window Music Player, which also allows Stored Cross-Site Scripting XSS. Recommendations: Update...

WordPress plugin Floating Window Music Player 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2025-22434

In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26448

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26448

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26448

The CVE-2025-26448 vulnerability is an information disclosure flaw: in CursorWindow.cpp, writeToParcel can trigger an out-of-bounds read due to uninitialized data. The impact is local information exposure without extra execution privileges, and exploitation does not require user interaction. Affe...

CVE-2025-26448

In writeToParcel of CursorWindow.cpp, there is a possible out of bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26422

CVE-2025-26422 affects Android’s WindowManagerService (dumpsys) where a missing permission check could allow a local elevation of privilege. The public description notes that exploitation requires local access with no extra privileges and no user interaction. Android security bulletin entries for...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26422

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

...

Linux Distros Unpatched Vulnerability : CVE-2016-7152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote...