CVE-2025-12621

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

EUVD-2025-38325

A stored cross-site scripting XSS vulnerability in the CrushFTP 11.3.750 Admin Panel Reports / 'Who Created Folder' allows authenticated attackers with permissions to create folders to inject malicious HTML/JavaScript...

CVE-2025-64490 SuiteCRM's Inconsistent RBAC Enforcement Enables Access Control Bypass

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and prior, 8.0.0-beta.1 through 8.9.0 allow a low-privileged user with a restrictive role to view and create work items through the Resource Calendar and project screens, even...

WordPress plugin Flexible Refund and Return Order for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the hostDisk process in the virt-handler component when mounting a host file or directory using the DiskOrCreate option. An attacker can gain unauthorized access to and modify...

CVE-2025-63638

Sourcecodester AI-Powered To-Do List App v1.0 is vulnerable to Cross-Site Scripting XSS in the "Task Title" and "Description Optional" fields when creating a Task, allowing an attacker to inject arbitrary potentially malicious HTML/JavaScript code that executes in the victim's browser upon clicki...

CVE-2025-12674

The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the createmedia function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990406)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990406 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to...

A Bootiful Podcast: The Vaadin team, live from Vaadin Create 2025

Hi, Spring fans! In this installment, I had the privilege to sit down with Vaadin legends Joonas Lehtinen, Marcus Hellberg, and Leif Åstrand at the amazing Vaadin Create 2025 event in Frankfurt, Germany...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990488)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990488 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmapipcreate function. When firstip is 0,...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990386)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990386 advisory. In the Linux kernel, the following vulnerability has been resolved: traceeventshist: add check for return value of 'createhistfield' Function 'createhistfield' is...

GO-2025-4021 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni

Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni...

CVE-2025-12676

CVE-2025-12676 concerns KiotViet Sync for WordPress (versions up to 1.8.5). According to multiple sources, the root cause is a hard-coded password used for authentication inside QueryControllerAdmin::authenticated, enabling unauthenticated attackers to create and sync products. Public details con...

CVE-2025-12674 KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload

The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the createmedia function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server...

WordPress plugin Document Embedder – Embed PDFs Word Excel and Other Files 安全漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. WordPress plugin Document Embedder -...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989436 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix possible refcount leak in tipcskcreate Free sk in case tipcskinsert fails. Tenable...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-989922)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989922 advisory. In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix possible refcount leak in tipcskcreate Free sk in case tipcskinsert fails. Tenable...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988724)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988724 advisory. In the Linux kernel, the following vulnerability has been resolved: ubi: ubicreatevolume: Fix use-after-free when volume creation failed There is an use-after-free...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990348)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990348 advisory. In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inetcreate sockinitdata attaches the allocated s...