PT-2025-4033 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI versions 2.1 and below Description: An Improper Access Control issue has been found, allowing an authenticated attacker to change their subscription plan without paying. This is achieved by making a POST request to the...

AZL-56105 CVE-2024-12705 affecting package bind for versions less than 9.20.5-1

Clients using DNS-over-HTTPS DoH can exhaust a DNS resolver's CPU and/or memory by flooding it with crafted valid or invalid HTTP/2 traffic. This issue affects BIND 9 versions 9.18.0 through 9.18.32, 9.20.0 through 9.20.4, 9.21.0 through 9.21.3, and 9.18.11-S1 through 9.18.32-S1...

WordPress Infility Global plugin < 2.9.9 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Infility Global versions 2.9.9...

CVE-2024-50066 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50066 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-0695

An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input...

CVE-2025-0695

An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input...

PT-2025-4004 · Cesanta · Cesanta Frozen

Name of the Vulnerable Software and Affected Versions: Cesanta Frozen versions less than 1.7 Description: An Allocation of Resources Without Limits or Throttling issue allows an attacker to induce a crash of the component embedding the library by supplying a maliciously crafted JSON as input...

Updatecli 安全漏洞

Updatecli is a declarative dependency management tool from the Updatecli open source. A security vulnerability exists in Updatecli versions prior to 0.93.0, which stems from the fact that private Maven repository credentials may be leaked to application logs if a retrieval operation fails...

CVE-2025-23475 WordPress History timeline plugin <= 0.7.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fireantology History timeline history-timeline allows Reflected XSS.This issue affects History timeline: from n/a through = 0.7.2...

CVE-2025-23696 WordPress Staging CDN plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ronan Mockett Staging CDN staging-cdn allows Reflected XSS.This issue affects Staging CDN: from n/a through = 1.0.0...

AZL-55965 CVE-2025-0395 affecting package glibc for versions less than 2.38-11

When the assert function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size...

Drupal AI (Artificial Intelligence) module < 1.0.3 - Unauthenticated Multiple Vulnerabilities vulnerability

Unauthenticated Multiple Vulnerabilities vulnerability discovered by Mingsong in WordPress Module AI Artificial Intelligence versions 1.0.3...

Drupal Ignition by Thrive Themes module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS vulnerability discovered by Dieter Holvoet in WordPress Module Ignition Error Pages versions 1.0.4...

AZL-58408 CVE-2025-21490 affecting package mariadb for versions less than 10.6.21-1

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

AZL-55889 CVE-2024-13176 affecting package openssl for versions less than 3.3.3-1

Issue summary: A timing side-channel which could potentially allow recovering the private key exists in the ECDSA signature computation. Impact summary: A timing side-channel in ECDSA signature computations could allow recovering the private key by an attacker. However, measuring the timing would...

PT-2025-10891

Name of the Vulnerable Software and Affected Versions Below versions prior to 0.9.0 Description A flaw exists in the Below service that allows for privilege escalation. This is due to the creation of a world-writable directory located at /var/log/below. Local, unprivileged users could exploit thi...

CVE-2024-57030

Wegia 3.2.0 is vulnerable to Cross Site Scripting XSS in /geral/documentosfuncionario.php via the id parameter...

Roundcube Webmail 1.5.x < 1.5.6 Cross-Site-Scripting

According to its self-reported version number, Roundcube Webmail is prior to 1.5.6 or 1.6.x prior to 1.6.5. Therefore, it may be affected by a Cross-Site Scripting XSS vulnerability via a Content-Type or Content-Disposition header. Note that the scanner has not tested for these issues but has...

WordPress Copy Move Posts plugin <= 1.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Copy Move Posts versions = 1.6...

WordPress Notifications Center plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika in WordPress Plugin Notifications Center versions = 1.5.2...