PT-2025-21512 · WordPress · Javascript Logic

Name of the Vulnerable Software and Affected Versions: JavaScript Logic WordPress plugin versions 0.1 and earlier Description: The issue concerns a lack of CSRF check in some areas of the plugin, along with missing sanitization and escaping. This could allow attackers to make logged-in admins add...

CVE-2025-32421 Next.js Race Condition to Cache Poisoning

Next.js is a React framework for building full-stack web applications. Versions prior to 14.2.24 and 15.1.6 have a race-condition vulnerability. This issue only affects the Pages Router under certain misconfigurations, causing normal endpoints to serve pageProps data instead of standard HTML. Thi...

GHSA-W9HF-35Q4-VCJW nosurf vulnerable to CSRF due to non-functional same-origin request checks

Impact This vulnerability allows an attacker who controls content on the target site, or on a subdomain of the target site either via XSS, or otherwise to bypass Cross-Site Request Forgery checks and issue requests on user's behalf. Details Due to misuse of the Go net/http library, nosurf...

GLSA-202505-05 : Orc: Arbitrary Code Execution

The remote host is affected by the vulnerability described in GLSA-202505-05 Orc: Arbitrary Code Execution Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory. Note that Nessus has no...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.15.50 bug fix and security update

Red Hat OpenShift Container Platform release 4.15.50 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.15. Red Hat Product Security has rated this update as having a...

PT-2025-20165 · Yaysmtp · Yaysmtp

Name of the Vulnerable Software and Affected Versions: YaySMTP versions n/a through 2.6.4 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This allows for Blind SQL Injection, which can be exploited...

Google Chrome < 136.0.7103.92 Vulnerability

The version of Google Chrome installed on the remote macOS host is prior to 136.0.7103.92. It is, therefore, affected by a vulnerability as referenced in the 202505stable-channel-update-for-desktop advisory. - Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote...

CVE-2025-46734

CVE-2025-46734 affects the PHP Markdown parser league/commonmark, specifically the Attributes extension (versions 1.5.0–2.6.x). The vulnerability allows injection of dangerous HTML attributes via Markdown syntax (e.g., curly braces) that can bypass HTML sanitization settings. Version 2.7.0 mitiga...

PT-2025-18585 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.11 Description: A vulnerability has been resolved in the Linux kernel. The issue is related to the phy: ralink: mt7621-pci driver, where a sentinel was added to the quirks table. With the correction of the...

PT-2025-18202 · Unknown · Pcman Ftp Server

Name of the Vulnerable Software and Affected Versions: PCMan FTP Server versions 2.0.0 through 2.0.7 Description: A critical vulnerability was found in the RENAME Command Handler component of PCMan FTP Server, leading to a buffer overflow. This issue can be exploited remotely. The vulnerability i...

WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Meta Keywords & Description versions = 0.8...

PT-2025-17894 · WordPress · 1 Decembrie 1918

Name of the Vulnerable Software and Affected Versions: 1 Decembrie 1918 plugin for WordPress versions up to, and including, 1.dec.2012 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the "1-decembrie-1918/1-decembrie-1918.php" page...

RUSTSEC-2025-0038 Out of bounds access in public safe API

Rows::rowunchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

PT-2025-23365 · Crates.Io · Arrow2

Rows::row unchecked allows out of bounds access to the underlying buffer without sufficient checks. The arrow2 crate is no longer maintained, so there are no plans to fix this issue. Users are advised to migrate to the arrow crate, instead...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover vulnerability

Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light versions = 2.4.37...

CVE-2025-32442

The CVE-2025-32442 issue affects Fastify (Node.js) where applications that specify different validation strategies for multiple content types can bypass validation by supplying a slightly altered Content-Type (e.g., different casing or whitespace before ";"). Affected versions include Fastify 5.0...

WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by johska Patchstack Alliance in WordPress Plugin I Draw versions = 1.0...

MAL-2025-3255 Malicious code in helper-member-expression-to-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e46054f993cedcc0d3d1aa68cb5224550c94097ec1d867f3d8dba501da7963f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-32783 XWiki allows unregistered users to see "public" messages from a closed wiki via notifications from a different wiki

XWiki Platform is a generic wiki platform. A vulnerability in versions from 5.0 to 16.7.1 affects users with Message Stream enabled and a wiki configured as closed from selecting "Prevent unregistered users to view pages" in the Administrations Rights. The vulnerability is that any message sent i...