UBUNTU-CVE-2025-38688

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

CVE-2025-38688 iommufd: Prevent ALIGN() overflow

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

CVE-2025-38688: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommufd: Prevent ALIGN overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONGMAX then the ALIGN can wrap resulting in a corrupted iova. Open code the ALIGN using...

CVE-2025-6221

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6221

CVE-2025-6221 affects the WordPress plugin Embed Bokun (≤0.23). Affected component: the align parameter; vulnerability type: Stored Cross‑Site Scripting . Conditions: authenticated attackers with at least Contributor rights can inject scripts that execute when any user visits the affected page. R...

CVE-2025-6221 Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6221 Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6221: Improper Neutralization of Input During Web Page Generation

The Embed Bokun plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 0.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

PT-2025-33524 · WordPress · Embed Bokun

Name of the Vulnerable Software and Affected Versions: Embed Bokun plugin for WordPress versions up to and including 0.23 Description: The Embed Bokun plugin for WordPress is susceptible to Stored Cross-Site Scripting via the align parameter due to insufficient input sanitization and output...

WordPress plugin Embed Bokun cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-5259

CVE-2025-5259: Minimal Share Buttons for WordPress is affected by a Stored Cross-Site Scripting (XSS) via the align parameter in all versions up to 1.7.3. The issue allows authenticated attackers with Contributor-level access and above to inject scripts that run when users visit injected pages. R...

WordPress plugin Minimal Share Buttons has a cross-site scripting vulnerability

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exist...

CVE-2025-5259: Improper Neutralization of Input During Web Page Generation

The Minimal Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

Security update for ffmpeg

This update for ffmpeg fixes the following issues: CVE-2025-22921: Clear array length when freeing it. bsc1237382 CVE-2025-0518: Fix memory data leak when use sscanf. bsc1236007 CVE-2025-22919: Check for valid sample rate, to fix the invalid sample rate = 0. bsc1237371 CVE-2024-12361: Add check f...

CVE-2025-3858

The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-3858 Formality <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter

The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

WordPress plugin Formality has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-3858: Improper Neutralization of Input During Web Page Generation

The Formality plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ parameter in all versions up to, and including, 1.5.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

Linux Kernel Buffer Overflow DoS

The vulnerabilities of the functions SKBHEADALIGN, netdevallocskb, and napiallocskb located in include/net/gro.h, net/core/gro.c, and net.core/skbuff.c in the Linux kernel are related to resource management errors. Exploiting these vulnerabilities can allow an attacker to cause service failures...

CVE-2024-9601

The Qubely – Advanced Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ and 'UniqueID' parameter in all versions up to, and including, 1.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...