CVE-2025-14454 Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

CVE-2025-13093: Missing Authorization

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

PT-2025-51061

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

CVE-2025-14454: Cross-Site Request Forgery (CSRF)

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

PT-2025-51048

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

WordPress plugin Image Slider by Ays – Responsive Slider and Carousel: Cross-site Request Forgery vulnerability

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...

OESA-2025-2823 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2822 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2824 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2821 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Exploitation Tool A comprehensive security res...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

CVE-2023-53840

The CVE-2023-53840 issue in the Linux kernel is fixed in the usb: early: xhci-dbc path. If xdbc_bulk_write() fails, the contents of buf could be non-deterministic and not NULL-terminated when xdbc_trace() runs, risking a potential out-of-bounds read. The patch reserves an extra byte in the static...

CVE-2023-53840 usb: early: xhci-dbc: Fix a potential out-of-bound memory access

In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbcbulkwrite fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbctrace is called. Reserve an extra byte,...

Nextcloud Server 31.0.0 File Tag Modification Vulnerability (GHSA-hq6c-r898-fgf2)

Nextcloud Server is prone to a file tag modification vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-12190

The Image Optimizer by wps.sk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to missing or incorrect nonce validation on the imagopbyajaxoptimizegallery function. This makes it possible for unauthenticated attackers to...

CVE-2025-66547

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1...

CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1...

CVE-2025-66547 Nextcloud Server users can modify tags on files that do not belong to them

Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 31.0.1, non-privileged users can modify tags on files they should not have access to via bulk tagging. This vulnerability is fixed in 31.0.1...

CVE-2025-66547

Nextcloud Server (and Enterprise Server) prior to 31.0.1 contains a vulnerability where non-privileged users can modify tags on files they should not access via bulk tagging. Affected product: Nextcloud Server/Enterprise Server; vulnerable component: file tagging mechanism. Root cause details are...