CVE-2025-11267

The VK All in One Expansion Unit WordPress plugin is affected by a Stored XSS in the _veu_custom_css value across versions up to 9.112.1. The vulnerability stems from insufficient input sanitization and output escaping, enabling authenticated attackers with Contributor-level access or higher to i...

PT-2025-47248

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit plugin for WordPress versions prior to 9.112.1 Description The software is susceptible to Stored Cross-Site Scripting through the veu custom css parameter. Insufficient input sanitization and output escaping on the...

WordPress ACF Flexible Layouts Manager plugin <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update vulnerability

Missing Authorization to Unauthenticated Custom Field Update vulnerability discovered by Ahmad Salem a7mad.cc in WordPress Plugin ACF Flexible Layouts Manager versions = 1.1.6...

GO-2025-4115 Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus

Incus vulnerable to local privilege escalation through custom storage volumes in github.com/lxc/incus...

GO-2025-4125 Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator

Observability Operator is vulnerable to Incorrect Privilege Assignment through its Custom Resource MonitorStack in github.com/rhobs/observability-operator...

CVE-2025-13232

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

Nuclei 3.5.1

Nuclei is a modern, high-performance vulnerability scanner that leverages simple YAML-based templates. It empowers you to design custom vulnerability detection scenarios that mimic real-world conditions, leading to zero false positives...

EUVD-2025-197711

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

CVE-2025-13232

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

CVE-2025-13232 projectsend File Editor/Custom Download Aliases cross site scripting

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

CVE-2025-13232 projectsend File Editor/Custom Download Aliases cross site scripting

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

CVE-2025-13232 projectsend File Editor/Custom Download Aliases cross site scripting

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to...

ProjectSend 代码注入漏洞

ProjectSend cFTP is the ProjectSend open source suite of self-hosted applications based on PHP and MySQL. A code injection vulnerability exists in ProjectSend r1720 and earlier versions, which stems from a misbehavior of the component File Editor/Custom Download Aliases and could lead to cross-si...

LXD vulnerable to a local privilege escalation through custom storage volumes

Impact This affects any LXD user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user. The most common case for this would be...

EUVD-2025-180203

LXD vulnerable to a local privilege escalation through custom storage volumes...

Incus vulnerable to local privilege escalation through custom storage volumes

Impact This affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true as well as access to the host as an unprivileged user. The most common case for this would ...

Malicious code in teate-thy-sonic-kotis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ef3bf1d1162ab66f6704380f31bedff135a962f261a38f335408ead6c5cbd37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

DRUPAL-CORE-2025-008

The core system module handles downloads of private and temporary files. Contrib modules can define additional kinds of files schemes that may also be handled by the system module. In some cases, files may be served with the HTTP header Cache-Control: public when they should be uncacheable. This...

MAL-2025-177386 Malicious code in poglymer-ogmih-affg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d80511ede6f618285808a799221e1559b8bd20968482e0c753732aae76e0876b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Important: Red Hat Security Advisory: Cluster Observability Operator 1.3.0

The Cluster Observability Operator COO is a Red Hat OpenShift Container Platform Operator that you can deploy to manage observability component stacks by using custom resource descriptions CRDs. The 1.3 release of COO...