CVE-2024-8286 GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

GHSA-8JHR-WPCM-HH4H label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

Summary The vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks. Details The vulnerability is reproducible when sending a properly formatted request to the POST...

label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

Summary The vulnerability allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, unauthorized actions on behalf of the user, and other attacks. Details The vulnerability is reproducible when sending a properly formatted request to the POST...

MAL-2025-3814 Malicious code in ai_challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cac3284458d7620929c88bceb52c6a1050042e2974e32bf76827af876c55b4be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12301: Cross-Site Request Forgery (CSRF)

The JSP Store Locator WordPress plugin through 1.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

PT-2025-21531 · WordPress · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Event Calendar WordPress plugin versions 1.0.0 through 1.0.4 Description: The issue concerns a lack of authorization checks on delete actions, allowing unauthenticated users to delete arbitrary calendars. This means that without proper...

Spotipy security vulnerability

Spotipy is spotipy-dev individual developer's lightweight Python library for the Spotify Web API. Spotipy suffers from a security vulnerability that stems from pullrequesttarget executing untrusted code in GitHub Actions, which could lead to credential disclosure and repository takeover...

CVE-2025-47928: Exposure of Data Element to Wrong Session

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2024-8286: Cross-Site Request Forgery (CSRF)

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2025-47783

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

CVE-2025-3877

Removed by vendor...

CVE-2025-26646

A flaw was found in .NET and Visual Studio. This vulnerability allows an attacker to use specially crafted input to spoof trusted content or identities, potentially misleading users or systems. This issue requires user interaction and limited privileges but can lead to unauthorized actions or...

PT-2025-21189 · Unknown · Restrict Route By Ip

Name of the Vulnerable Software and Affected Versions: Restrict route by IP versions 0.0.0 through 1.2.x Restrict route by IP version 1.3.0 is not affected, so the correct range is: Restrict route by IP versions 0.0.0 through 1.2.x Description: A Cross-Site Request Forgery CSRF issue affects the...

xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...

Description of the security update for SharePoint Enterprise Server 2016 Language Pack: May 13, 2025 (KB5002712)

Description of the security update for SharePoint Enterprise Server 2016 Language Pack: May 13, 2025 KB5002712 Applies To SharePoint Server 2016 Summary This security update resolves a Microsoft SharePoint Server elevation of privilege vulnerability. To learn more about the vulnerability, see...

Description of the security update for SharePoint Enterprise Server 2016: May 13, 2025 (KB5002722)

Description of the security update for SharePoint Enterprise Server 2016: May 13, 2025 KB5002722 Applies To SharePoint Server 2016 Summary This security update resolves a Microsoft SharePoint Server remote code execution vulnerability and Microsoft SharePoint Server elevation of privilege...

CVE-2025-40626 Reflected Cross-Site Scripting (XSS) in AbanteCart

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

Power actions are pending and never be executed

Customer's power actions are pending and never be executed...

📄 RDPGuard 9.9.9 Privilege Escalation

RDPGuard version 9.9.9 suffers from a privilege escalation vulnerability. Exploit Title: RDPGuard 9.9.9 - Privilege Escalation SYSTEM Discovered by: Ahmet Ümit BAYRAM Discovered Date: 09.05.2025 Vendor Homepage: https://rdpguard.com Software Link: https://rdpguard.com/download.aspx Tested Version...

CVE-2025-46812

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the...