CVE-2025-5071: Incorrect Authorization

The AI Engine plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'MeowMWAILabsMCP::canaccessmcp' function in versions 2.8.0 to 2.8.3. This makes it possible for authenticated attackers, with subscriber-level access and...

Ruby Rack Unauthorized Access

The vulnerability of the Ruby interpreter’s Rack module interface is related to the failure to handle CRLF sequences properly. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access and modify protected information...

WordPress plugin GiveWP has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress Plugin AI Engine security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. An unspecified vulnerability exists in WordPress AI Engine plugin that stems from a lack of capability checking, which can be exploited by attackers to cause unauthorized data...

CVE-2025-3880

The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on several functions in all versions up to, and including, 19.9.0. This makes it possible for authenticated attackers, with...

CVE-2025-3880

CVE-2025-3880 concerns the WordPress plugin Poll, Survey & Quiz Maker by Opinion Stage. A misconfigured capability check allows authenticated attackers with Contributor-level access and above to perform unauthorized data modification, specifically changing the account connection email and disconn...

XWiki Platform NotificationEmailRendererClass Access Disclosure

The vulnerability of the NotificationEmailRendererClass class in the XWiki Platform’s collaborative web application development platform involves shortcomings in access control when processing templates. Exploiting this vulnerability could allow a malicious actor to gain access to read and modify...

PT-2025-25644 · WordPress · The Poll

Name of the Vulnerable Software and Affected Versions: The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress versions up to, and including, 19.9.0 Description: The issue is related to a misconfigured capability check on several functions, allowing authenticated attackers with...

SUSE-SU-2025:1487-1 Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Upgrade to upstream tag jdk-11.0.27+6 April 2025 CPU CVEs: + CVE-2025-21587: Fixed JSSE unauthorized access, deletion or modification of critical data bsc1241274 + CVE-2025-30691: Fixed Oracle Java SE Compiler Unauthorized Data Access...

Visual Composer SAP NetWeaver Data Access

The vulnerability of the Visual Composer web tool, a software modeling tool within the SAP NetWeaver integration platform, is related to an incorrect restriction on the path to the restricted access catalog. Exploiting this vulnerability could allow an attacker to gain read and modify access to...

Security update for java-1_8_0-openj9

This update for java-180-openj9 fixes the following issues: CVE-2025-4447: Fixed buffer overflow in Eclipse OpenJ9 bsc1243429. CVE-2025-30698: Fixed 2D unauthorized data access and DoS bsc1241276. CVE-2025-30691: Fixed Compiler Unauthorized Data Access bsc1241275. CVE-2025-21587: Fixed unauthoriz...

CVE-2025-5815

The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcmmaybesetbotflags function in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to disabled bot logging...

PT-2025-25383

Name of the Vulnerable Software and Affected Versions The Traffic Monitor plugin for WordPress versions up to, and including, 3.2.2 Description The issue is related to unauthorized modification of data due to a missing capability check on the tfcm maybe set bot flags function. This allows...

CVE-2025-49196

CVE-2025-49196 is associated in connected sources with SICK Field Analytics and SICK Media Server, where the vulnerability stems from supporting a deprecated and unsafe TLS version. Impacts are described as affecting confidentiality and integrity; exploitation details are not provided, and public...

PT-2025-25351 · Aveva · Aveva Pi Connector For Cygnet

Name of the Vulnerable Software and Affected Versions: AVEVA PI Connector for CygNet versions 1.6.14 and prior Description: An improper validation of integrity check value issue exists that, if exploited, could allow a miscreant with elevated privileges to modify local data files in a way that...

PYSEC-2025-74

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

PYSEC-2025-79

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

PYSEC-2025-74

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

CVE-2025-49142

Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configuration of the Jinja2 templating feature used in computed fields, custom links, etc. in Nautobot, a...

CVE-2025-3117

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...