CVE-2025-34226 OpenPLC Runtime v3 Persistent DoS

OpenPLC Runtime v3 contains an input validation flaw in the /upload-program-action endpoint: the epochtime field supplied during program uploads is not validated and can be crafted to induce corruption of the programs database. After a successful malformed upload the runtime continues to operate...

DEBIAN-CVE-2025-49641

A regular Zabbix user with no permission to the Monitoring - Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems...

CVE-2025-9945

CVE-2025-9945 affects the WordPress plugin “Optimize More! – CSS” (versions up to 1.0.3). The issue is a Cross-Site Request Forgery caused by missing/incorrect nonce validation in the reset_plugin function, allowing unauthenticated attackers to trigger a site administrator action to reset plugin ...

CVE-2025-9884

The CVE-2025-9884 entry concerns the WordPress plugin Mobile Site Redirect (versions up to and including 1.2.1). The issue is a Cross-Site Request Forgery (CSRF) that, due to missing or incorrect nonce validation, can allow unauthenticated attackers to induce a site administrator to perform actio...

EUVD-2025-32282

The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation in the '/includes/admin/class-mpwizard-table.php' file. This makes it possible for...

CVE-2025-9697

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

PT-2025-40510

Name of the Vulnerable Software and Affected Versions Optimize More! – CSS plugin for WordPress versions up to and including 1.0.3 Description The software is susceptible to a Cross-Site Request Forgery issue. This is caused by a lack of, or incorrect, nonce validation within the reset plugin...

PT-2025-40533

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description The software contains an input validation flaw in the /upload-program-action API endpoint. The epoch time parameter, when submitting program uploads, is not validated, potentially leading to corruption of...

CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their...

CVE-2025-22862

An Authentication Bypass Using an Alternate Path or Channel vulnerability CWE-288 in FortiOS 7.4.0 through 7.4.7, 7.2.0 through 7.2.11, 7.0.6 and above; and FortiProxy 7.6.0 through 7.6.2, 7.4.0 through 7.4.8, 7.2 all versions, 7.0.5 and above may allow an authenticated attacker to elevate their...

CVE-2025-9697

The Ajax WooSearch WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-9697

CVE-2025-9697 affects the Ajax WooSearch WordPress plugin (versions

CVE-2025-9587 CTL Behance Importer Lite <= 1.0 - Unauthenticated SQL Injection

The CTL Behance Importer Lite WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-9587

CVE-2025-9587 affects the WordPress plugin CTL Behance Importer Lite (versions up to 1.0). The vulnerability is a SQL injection caused by improper sanitization/escaping of a parameter before it is used in a SQL statement via an unauthenticated AJAX action. Multiple connected sources (Red Hat advi...

CVE-2025-23293

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23292

NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to partial denial of service UI component...

CVE-2025-23291

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action. A successful exploit of this vulnerability may lead to information disclosure...

CVE-2025-23291

CVE-2025-23291 affects the NVIDIA Delegated Licensing Service (DLS) for all appliance platforms. The vulnerability could allow an attacker to perform an unauthorized action, potentially leading to information disclosure. NVIDIA’s security bulletin lists fixes in DLS updates: versions ≥3.5.1 (for ...

CVE-2025-61584

serverless-dns is a RethinkDNS resolver that deploys to Cloudflare Workers, Deno Deploy, Fastly, and Fly.io. Versions through abd including 0.1.30 have a vulnerability where the pr.yml GitHub Action interpolates in an unsafe manner untrusted input, specifically the...

CVE-2025-61584

serverless-dns (versions up to 0.1.30) contains a vulnerability in the pr.yml GitHub Action where unsafe input (github.event.pull_request.head.repo.clone_url and github.head_ref) is interpolated into a command executed by the runner. Because the action uses the pull_request_target trigger, it run...