6414 matches found
WordPress Jetpack plugin < 3.4.8 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack Boost versions 3.4.8...
SUSE CVE-2025-3875
Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name ", Thunderbird treats [email protected] as the actual address. This vulnerability was fixed ...
CVE-2024-9765 EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability
The EKC Tournament Manager WordPress plugin before 2.2.2 allows a logged in admin to download system files outside of the WordPress directory...
CVE-2024-13357 Ditty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS
The Ditty WordPress plugin before 3.1.52 does not sanitise and escape some of its settings, which could allow high privilege users such as author to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
firefox: thunderbird: Memory safety bug fixed in Firefox ESR 128.10 and Thunderbird 128.10
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run...
AZL-61870 CVE-2025-4516 affecting package python3 for versions less than 3.12.9-2
There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode call in ...
WordPress Responsive Lightbox & Gallery plugin < 2.5.1 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Pierre Rudloff in WordPress Plugin Responsive Lightbox versions 2.5.1...
Drupal One Time Password module < 1.3.0 - Unauthenticated Broken Access Control vulnerability
Unauthenticated Broken Access Control vulnerability discovered by Conrad Lara cmlara in WordPress Module One Time Password versions 1.3.0...
Drupal Single Content Sync module < 1.4.12 - Authenticated Broken Access Control vulnerability
Authenticated Broken Access Control vulnerability discovered by Dezső Biczó mxr576 in WordPress Module Single Content Sync versions 1.4.12...
Drupal Events Log Track module < 3.1.11,4.0.0-4.0.1 - Unauthenticated Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack vulnerability discovered by Scott Phillips scottatdrake in WordPress Module Events Log Track versions 3.1.11,4.0.0-4.0.1...
AZL-61830 CVE-2025-4574 affecting package rust for versions less than 1.75.0-16
In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption...
AZL-61845 CVE-2025-4574 affecting package rust for versions less than 1.86.0-3
In crossbeam-channel rust crate, the internal Channel type's Drop method has a race condition which could, in some circumstances, lead to a double-free that could result in memory corruption...
firefox: thunderbird: Use-after-free triggered by XSLTProcessor
A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free...
CVE-2025-31930
A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...
AZL-67797 CVE-2025-22247 affecting package open-vm-tools for versions less than 11.3.0-4
VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to trigger insecure file operations within that VM...
Drupal COOKiES Consent Management module < 1.2.14 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module COOKiES Consent Management versions 1.2.14...
PT-2025-20232 · Syslog-Ng +1 · Syslog-Ng +1
Name of the Vulnerable Software and Affected Versions: syslog-ng versions prior to 4.8.2 syslog-ng version 3.28.1-2+deb11u2 and earlier for Debian 11 bullseye Description: syslog-ng is an enhanced log daemon. Prior to version 4.8.2, tls wildcard match matches on certificates such as foo..bar...
Drupal Klaro Cookie & Consent Management module < 3.0.5 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module Klaro Cookie & Consent Management versions 3.0.5...
Google Chrome < 136.0.7103.92 Vulnerability
The version of Google Chrome installed on the remote Windows host is prior to 136.0.7103.92. It is, therefore, affected by a vulnerability as referenced in the 202505stable-channel-update-for-desktop advisory. - Use after free in WebAudio in Google Chrome prior to 136.0.7103.92 allowed a remote...
