PT-2025-46233

Name of the Vulnerable Software and Affected Versions SAP Business Connector affected versions not specified Description An unauthenticated attacker can exploit an Open Redirect flaw in SAP Business Connector by creating a malicious URL. If a user accesses this URL, they are redirected to a websi...

WordPress All in One Time Clock Lite plugin unauthorized access vulnerability

WordPress All in One Time Clock Lite plugin is a plugin for tracking employee attendance and supports clock-in record management for employees, volunteers and contractors. An unauthorized access vulnerability exists in WordPress All in One Time Clock Lite plugin, which stems from a lack of...

WordPress Easy Email Subscription plugin Cross-Site Request Forgery Vulnerability

WordPress Easy Email Subscription plugin is a plugin for adding email subscription functionality to your WordPress website. The WordPress Easy Email Subscription plugin suffers from a cross-site request forgery vulnerability that originates from a web application that does not adequately validate...

PT-2025-46278

Name of the Vulnerable Software and Affected Versions WP-Walla plugin for WordPress versions up to and including 0.5.3.5 Description The WP-Walla plugin for WordPress is susceptible to Cross-Site Request Forgery leading to Stored Cross-Site Scripting. This is a result of lacking nonce verificatio...

Lucee Unset Credentials

Lucee web application server may be configured with no credentials. If an attacker setup the default accounts, they could gain unauthorized access to the application and perform arbitrary actions on it. No source data...

CVE-2025-63710: Cross-Site Request Forgery (CSRF)

The sendmessage.php endpoint in SourceCodester Simple Public Chat Room 1.0 is vulnerable to Cross-Site Request Forgery CSRF. The application does not implement any CSRF-protection mechanisms such as tokens, nonces, or same-site cookie restrictions. An attacker can create a malicious HTML page tha...

CVE-2025-7663

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files,...

AZL-69796 CVE-2025-64434 affecting package kubevirt for versions less than 1.5.3-2

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler via verifyPeerCert, an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileg...

CVE-2025-64434

KubeVirt Vulnerability CVE-2025-64434 affects virt-handler’s peer verification (verifyPeerCert). In affected releases prior to 1.5.3 and 1.6.1, a compromised virt-handler could exploit shared credentials to impersonate virt-api and perform privileged operations against other virt-handler instance...

CVE-2025-64326

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

PT-2025-45478

Name of the Vulnerable Software and Affected Versions SourceCodester Leads Manager Tool version 1.0 Description The application is susceptible to Cross-Site Request Forgery CSRF attacks, enabling unauthorized modification of application state. The application does not implement CSRF protection...

KubeVirt's Improper TLS Certificate Management Handling Allows API Identity Spoofing

Summary Due to improper TLS certificate management, a compromised virt-handler could impersonate virt-api by using its own TLS credentials, allowing it to initiate privileged operations against another virt-handler. Details Give all details on the vulnerability. Pointing to the incriminated sourc...

PYSEC-2025-230

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

CVE-2025-64326 Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

CVE-2025-53214

CVE-2025-53214 concerns the WordPress plugin Sertifier Certificate & Badge Maker (versions

PT-2025-45301

Name of the Vulnerable Software and Affected Versions uxper Togo versions prior to 1.0.4 Description An incorrect privilege assignment issue exists in uxper Togo togo. The issue involves improper access control, potentially allowing unauthorized actions. Recommendations Update uxper Togo to versi...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990564)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990564 advisory. In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch...

GHSA-GR35-VPX2-QXHC Weblate leaks the IP of project member inviting user to be reviewer in Audit log

Summary Weblate leaks the IP address of the project member inviting the user to the project in the audit log. Details The audit log included IP addresses from admin-triggered actions, and those could be viewed by invited users. Impact The inviting user's admin's IP address could be leaked to...

django-autoconfig (>=0.6.0, <=0.7.2), django-cache-manager (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2025-64458 via django (1.11.0rc1)

django PYPI version 1.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-autoconfig =0.6.0, =0.5.0, =0.5.1 - django-inline-actions 1.1.0 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...

django-autoconfig (>=0.6.0, <=0.7.2), django-cache-manager (>=0.5.0, <=0.5.1) +1 more potentially affected by CVE-2025-64459 via django (1.11.0rc1)

django PYPI version 1.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-autoconfig =0.6.0, =0.5.0, =0.5.1 - django-inline-actions 1.1.0 Source cves: CVE-2025-64459 Source advisory: OSV:GHSA-FRMV-PR5F-9MCR...