CVE-2025-20157

Cisco Catalyst SD-WAN Manager (Cisco SD-WAN vManage) contains a certificate validation vulnerability in the Smart Licensing workflow. The issue arises from improper validation of certificates used by Smart Licensing, allowing an unauthenticated, remote attacker with network access to intercept tr...

CVE-2025-20961

The connected PT-2025-20046 entry provides concrete details for CVE-2025-20961: the vulnerability affects the sepunion service, with improper handling of insufficient privileges allowing local privileged attackers to access files with system privileges. Affected versions are prior to SMR May-2025...

CVE-2025-26241

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket =1.17.5 allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination...

CVE-2024-42213

HCL BigFix Compliance is affected by inclusion of temporary files left in the production environment. An attacker might gain access to these files by indexing or retrieved via predictable URLs or misconfigured permissions, leading to information disclosure...

CVE-2024-42213

CVE-2024-42213 affects HCL BigFix Compliance. The issue is the inclusion of temporary files left in production, which could be exposed via indexing, predictable URLs, or misconfigured permissions, causing information disclosure. CVSSv3.1 base score is 5.3 (Medium); attack vector: network; impact ...

CVE-2025-3510

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-4099

The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'listchildren' shortcode in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-1326

The Homey theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the homeyreservationdel function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete...

CVE-2025-4131

CVE-2025-4131 covers the WordPress plugin GmapsMania. The vulnerability is a Stored Cross-Site Scripting via the plugin’s gmap shortcode in all versions up to and including 1.1, caused by insufficient input sanitization and output escaping of user-supplied attributes. The impact is that authentic...

The vulnerability of the powerpc/fadump components in the Linux operating system’s kernel allows a hacker to gain elevated privileges within the system.

The vulnerability of the powerpc/fadump components in the Linux operating system’s kernel is related to an incorrect use after release. Exploiting this vulnerability can allow an attacker to increase their privileges within the system...

The vulnerability of the Linux operating system’s USB kernel component, which allows a hacker to cause a service failure

The vulnerability of the Linux operating system’s USB kernel component is related to the assignment of the NULL pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-3874

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and...

CVE-2025-4100

The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'npmarinetrafficmap' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

The vulnerability of Xen hypervisors relates to the incorrect sequence of processor instructions, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Xen hypervisors is related to an incorrect sequence of processor instructions, due to the absence of the ENDBR instruction and a prologue/eepilog for CFI schemes based on hash. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access ...

CVE-2024-13808

The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.9 via the custom PHP widget. This is due to their only being client side controls when determining who can access the widget. This makes it possible for...

The vulnerability of the Jenkins automation server, related to insufficient protection of service data, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Jenkins automation server is related to insufficient protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection via the saveService function. If dynamic service registration is enabled which it is not by default, a privileged attacker with access to the saveService interface and the ability to modify application.properties can...

CVE-2025-2543

The Advanced Accordion Gutenberg Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-lev...

CVE-2025-3058

The Xelion Webchat plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the xwcsavesettings function in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers, with...

CVE-2025-29316

An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive information. NOTE: the Supplier disputes the Print Job Watermark Bypass claim because the watermark is added by hooking into the OS printing mechanism, and th...