CVE-2024-56328 HTMLi(XSS without CSP) via Onebox urls in Discourse

Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a maliciously crafted onebox url. This issue only affects sites with CSP disabled. This problem has been patched in the latest version of Discourse. Users are...

CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2025-23023 Anonymous cache poisoning via request headers in Discourse

Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to poison the anonymous cache for example, the cache may have a response with missing preloaded data. This issue only affects anonymous...

CVE-2025-20907

Improper privilege management in Samsung Find prior to SMR Feb-2025 Release 1 allows local privileged attackers to disable Samsung Find...

CVE-2025-20907

CVE-2025-20907 affects Samsung Find prior to SMR Feb-2025 Release 1. The issue is improper privilege management that allows local privileged attackers to disable Samsung Find. Affected: Samsung Find versions before SMR Feb-2025 Release 1. Impact: local attacker with sufficient privileges can disa...

PT-2025-2112

Name of the Vulnerable Software and Affected Versions iBuildApp WordPress plugin versions 0.2.0 and earlier Description The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitized and escaped before being outputted back in the page. This could be...

PT-2025-2118 · WordPress · Transfinanz Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: TransFinanz WordPress plugin version 1.0.0 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be used...

PT-2025-5612 · Dumpdrop · Dumpdrop

Name of the Vulnerable Software and Affected Versions: DumpDrop affected versions not specified Description: The issue is related to an OS Command Injection vulnerability in the DumpDrop application, specifically in the "/upload/init" endpoint. This vulnerability could allow an attacker to execut...

PT-2025-7112 · Tp Link · Tp-Link Tl-Wr841Nd

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR841ND version V11 Description: A buffer overflow issue was discovered via the pskSecret parameter at the "/userRpm/WlanSecurityRpm.htm" API endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted...

PT-2025-2116

Name of the Vulnerable Software and Affected Versions JustRows free WordPress plugin versions 0.2 and earlier Description The issue arises from the plugin not sanitising and escaping a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. This could be used...

PT-2025-5607

Name of the Vulnerable Software and Affected Versions: Vitest versions prior to 2.1.9 Vitest versions prior to 3.0.4 Description: The screenshot-error handler on the browser mode HTTP server responds to any file on the file system. If the server is exposed on the network by browser.api.host: true...

PT-2025-3011 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: The issue affects users who disable chat in preferences but could still be reachable in some cases. The estimated number of potentially affected devices worldwide is not available...

PT-2025-4188 · Samsung · Samsung Find

Name of the Vulnerable Software and Affected Versions: Samsung Find versions prior to SMR Feb-2025 Release 1 Description: The issue is related to improper privilege management, allowing local privileged attackers to disable Samsung Find. This can be exploited by attackers with local access and...

WordPress Disable Elementor Editor Translation plugin <= 1.0.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin Disable Elementor Editor Translation versions = 1.0.2...

SUSE-SU-2025:20011-1 Security update for qemu

This update for qemu fixes the following issues: - Update to version 8.2.5: target/loongarch: fix a wrong print in cpu dump ui/sdl2: Allow host to power down screen target/i386: fix SSE and SSE2 feature check target/i386: fix xsave.flat from kvm-unit-tests disas/riscv: Decode all of the pmpcfg an...

PT-2025-3402 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.8 Description: The issue allows attackers to execute arbitrary code and potentially take control of the server by constructing a payload in the classview parameter of the model management feature. This enables them to explo...

PT-2025-3005 · Nradio · Nradio N8-180 Nros

Name of the Vulnerable Software and Affected Versions: NRadio N8-180 NROS version 1.9.2.n3.c5 Description: An issue was discovered in NRadio devices, where the "/cgi-bin/luci/nradio/basic/radio" endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters. This allows an attacker to...

PT-2025-2125 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: Essential WP Real Estate WordPress plugin versions 1.1.3 and earlier Description: The issue is related to Reflected Cross-Site Scripting, where generated URLs are not properly escaped before being outputted in attributes. This can lead to...

PT-2025-5202 · Unknown · Notfound Lockets

Name of the Vulnerable Software and Affected Versions: NotFound Lockets versions n/a through 0.999 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. Recommendations: For versions n/a...

PT-2025-3740 · Arm · Arm 5Th Gen Gpu Architecture Kernel Driver +1

Name of the Vulnerable Software and Affected Versions: Valhall GPU Kernel Driver versions r48p0 through r49p1, versions r50p0 through r52p0 Arm 5th Gen GPU Architecture Kernel Driver versions r48p0 through r49p1, versions r50p0 through r52p0 Description: The issue allows a local non-privileged us...