delegate-dom (>=0.0.0, <=0.0.1), dom-delegation-stream (0.0.0) +2 more potentially affected by unknown CVE via matches-dom-selector (0.0.0)

matches-dom-selector NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on matches-dom-selector and may be impacted: - delegate-dom =0.0.0, =1.0.0, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-25996...

Malicious code in understory-editor (npm)

The package understory-editor was found to contain malicious code...

MAL-2025-28503 Malicious code in ory-editor-renderer-hubside (npm)

The package ory-editor-renderer-hubside was found to contain malicious code...

MAL-2025-37721 Malicious code in understory-editor (npm)

The package understory-editor was found to contain malicious code...

MAL-2025-28502 Malicious code in ory-editor-core-hubside (npm)

The package ory-editor-core-hubside was found to contain malicious code...

MAL-2025-36839 Malicious code in three-editor-release (npm)

The package three-editor-release was found to contain malicious code...

Malicious code in rule-editor (npm)

The package rule-editor was found to contain malicious code...

Malicious code in three-editor-release (npm)

The package three-editor-release was found to contain malicious code...

Malicious code in ory-editor-core-hubside (npm)

The package ory-editor-core-hubside was found to contain malicious code...

MAL-2025-40553 Malicious code in ymail-editor (npm)

The package ymail-editor was found to contain malicious code...

MAL-2025-39052 Malicious code in webtask-sequence-editor (npm)

The package webtask-sequence-editor was found to contain malicious code...

WordPress RSS Feed Pro Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin RSS Feed Pro versions = 1.1.8...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-52712 WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Path Traversal Vulnerability

Path Traversal: '.../...//' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Path Traversal.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.8...

CVE-2025-52712

CVE-2025-52712 is a Path Traversal vulnerability in WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor, affecting versions up to 1.27.8. Technical details across sources confirm the issue is a path traversal flaw (root cause: improper handling of file paths) that could enab...

CVE-2012-10054

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE

Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter,...

CVE-2012-10054

Umbraco CMS

CVE-2025-51691

Cross-Site Scripting XSS vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 May 2025 allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before renderin...

WordPress WP Airdrop Manager plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin WP Airdrop Manager versions = 1.0.5...