14199 matches found
GHSA-VVGC-356P-C3XW vulnerabilities
Vulnerabilities for packages: nodetaint, bom, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, kubernetes-dns-node-cache, docker-machine-driver-linode, crossplane-provider-aws-firehose, kubeflow, thanos, terraform-provider-azapi,...
CVE-2025-22872 vulnerabilities
Vulnerabilities for packages: nodetaint, bom, cni-plugins, restic, src-fingerprint, temporal-ui-server, falcosidekick, fluent-bit-plugin-loki, kubernetes-dns-node-cache, docker-machine-driver-linode, crossplane-provider-aws-firehose, kubeflow, thanos, terraform-provider-azapi,...
xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey()
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because t...
MAL-2025-3235 Malicious code in dc-genai-dropin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4921314e7e97ba500355f996a14c9619cadf54912d2dfdbe5eb22750a5e5c1c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-29722
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...
PT-2025-16992 · Pixelgrade · Style Manager
Name of the Vulnerable Software and Affected Versions: pixelgrade Style Manager versions 2.2.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an...
CVE-2025-29722
A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...
CVE-2025-29722
CVE-2025-29722 is a CSRF vulnerability in Commercify v1.0 due to missing CSRF protection on sensitive endpoints. The root cause is lack of CSRF tokens with permissive cookies/CORS, enabling attackers to perform unauthorized actions on behalf of authenticated users (example: settings changes via e...
PT-2025-17215 · Unknown · Commercify
Name of the Vulnerable Software and Affected Versions: Commercify version 1.0 Description: A CSRF issue allows remote attackers to perform unauthorized actions on behalf of authenticated users due to missing CSRF protection on sensitive endpoints. Recommendations: For Commercify version 1.0,...
PT-2025-17005 · Unknown · Momen2009 Theme Changer
Name of the Vulnerable Software and Affected Versions: momen2009 Theme Changer versions 1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This is a type of attack where an attack...
PT-2025-17021 · Unknown · Claire Ryan Author Showcase
Name of the Vulnerable Software and Affected Versions: Claire Ryan Author Showcase versions 1.4.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables an attacker ...
CVE-2025-30215
A flaw was found in NATS-SERVER. In affected versions of NATS-SERVER, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially exposed into regular accounts to allow account holders to manage their assets. Some JS API requests...
PT-2025-16805 · Unknown · Woocommerce - Social Login
Name of the Vulnerable Software and Affected Versions: WooCommerce Social Login versions 2.8.2 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This issue may be exploited to perform actions...
CVE-2025-31360
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-31360
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-30512
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-30512
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-31360
CVE-2025-31360 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can trigger device actions associated with specific “scenes” of arbitrary users, implying remote control of devices without user interaction. The vulnerability ...