GHSA-XWGG-M7FX-83WX Gardener External DNS Management allows malicious google credential in DNS secret to lead to privilege escalation

A security vulnerability was discovered in Gardener that could allow a user with administrative privileges for a Gardener project or a user with administrative privileges for a shoot cluster, including administrative privileges for a single namespace of the shoot cluster, to obtain control over t...

Local Privilege Escalation

github.com/redhatinsights/yggdrasil is vulnerable to local privilege escalation. The vulnerability is due to missing authentication and authorization checks on a DBus method that dispatches messages to worker processes, allowing any local user to trigger privileged package management actions...

MAL-2025-3985 Malicious code in babel-loader-fs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1700e85206eea0c06ca2bedd5155e402644feb176d29155bb5194ebaa3096336 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-22050 · WordPress · Wp Vegas

Name of the Vulnerable Software and Affected Versions: WP Vegas versions n/a through 2.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject malicious...

PT-2025-21956 · Google · Recaptcha

Name of the Vulnerable Software and Affected Versions: reCAPTCHA for all versions n/a through 2.26 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross Site Request Forgery. This means an attacker can trick a user into performing unintended actions on a web...

PT-2025-21994 · Unknown · Rootspersona

Name of the Vulnerable Software and Affected Versions: Rootspersona versions 3.7.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue may be exploited by an attacker to perform action...

PT-2025-22032 · Unknown · Ashok G Easy Child Theme Creator

Name of the Vulnerable Software and Affected Versions: Ashok G Easy Child Theme Creator versions 1.3.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This can be exploited by tricking a user...

PT-2025-21975 · Unknown · Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Code for WooCommerce versions 1.5.0 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows for Cross Site Request Forgery. This means an attacker can trick a user into performing unintended...

PT-2025-21987 · Woocommerce · Japanized For Woocommerce

Name of the Vulnerable Software and Affected Versions: Japanized For WooCommerce versions 2.6.40 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue can be exploited by tricking a user...

Exploit for CVE-2025-32259

WP ULike ≤ 4.7.9.1 - Unauthenticated Content Spoof CVE-2025-3...

CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

PT-2025-21679 · WordPress · Wp Ultimate Tours Builder

Name of the Vulnerable Software and Affected Versions: WP Ultimate Tours Builder versions 1.055 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the loopus WP Ultimate Tours Builder, allowing unauthorized actions to be performed on behalf of a user. This is a type of attac...

PT-2025-21671 · Themeton · Themeton Seven Stars

Name of the Vulnerable Software and Affected Versions: themeton Seven Stars versions 1.4.4 and earlier Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions without the user's knowledge ...

CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

UBUNTU-CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2024-8700

The Event Calendar WordPress plugin through 1.0.4 does not check for authorization on delete actions, allowing unauthenticated users to delete arbitrary calendars...

CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2024-8286

The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting visit logs via CSRF attacks...

CVE-2025-47928

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...

CVE-2025-47928 Spotipy repo vulnerable to secrets exfiltration via `pull_request_target`

Spotipy is a Python library for the Spotify Web API. As of commit 4f5759dbfb4506c7b6280572a4db1aabc1ac778d, using pullrequesttarget on .github/workflows/integrationtests.yml followed by the checking out the head.sha of a forked PR can be exploited by attackers, since untrusted code can be execute...