CVE-2025-27183: Out-of-bounds Write

After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2025-15605 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: After Effects versions 25.1, 24.6.4 and earlier Description: The issue is an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR...

Adobe After Effects < 24.6.5 / 25.0 < 25.2 Multiple Vulnerabilities (APSB25-23) (macOS)

The version of Adobe After Effects installed on the remote macOS host is prior to 24.6.5, 25.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-23 advisory. - Out-of-bounds Write CWE-787 potentially leading to Arbitrary code execution CVE-2025-27182,...

CVE-2025-27187: Out-of-bounds Read

After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a...

CVE-2025-27204: Out-of-bounds Read

After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a...

Adobe After Effects < 24.6.5 / 25.0 < 25.2 Multiple Vulnerabilities (APSB25-23)

The version of Adobe After Effects installed on the remote Windows host is prior to 24.6.5, 25.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-23 advisory. - Out-of-bounds Write CWE-787 potentially leading to Arbitrary code execution CVE-2025-27182,...

CVE-2025-27185: NULL Pointer Dereference

After Effects versions 25.1, 24.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this iss...

APSB25-23 : Security update available for Adobe After Effects

Adobe has released an update for Adobe After Effects for Windows and macOS. This update addresses critical and important security vulnerabilities. Successful exploitation could lead to arbitrary code execution, memory leak and application denial-of-service in the context of the current user...

CVE-2025-31747

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in milan.latinovic WP Chrono wp-chrono allows DOM-Based XSS.This issue affects WP Chrono: from n/a through = 1.5.4...

Citrix Virtual Apps and Desktops 2402 - Custom Application menus cut off after VDA upgrade

After upgrading the VDA from VDA 1912 to VDA 2402, users may notice that the fonts and graphics are not fitting within the custom application UI. Issue is generally seen when the client display has high resolution. Setting the High DPI setting on the Citrix Workspace App for Windows to Yes, may...

CVE-2025-0433: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2024-9618: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.0.7.2 due to insufficient input sanitization and output...

CVE-2025-23405

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

CVE-2025-23405

CVE-2025-23405 affects the Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application. The root issue is unauthenticated logging that can affect metrics collection and incident response, with an associated risk of log injection. The NVD/NIST record notes network-exposed co...

CVE-2025-1560

CVE-2025-1560 (WOW Entrance Effects WEE!) is a stored XSS vulnerability in the WordPress plugin WOW Entrance Effects (WEE!) up to version 0.1. The issue stems from insufficient input sanitization and output escaping in the plugin’s wee shortcode attributes, allowing authenticated attackers with c...

CVE-2025-1560 WOW Entrance Effects (WEE!) <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WOW Entrance Effects WEE! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-1560: Improper Neutralization of Input During Web Page Generation

The WOW Entrance Effects WEE! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wee' shortcode in all versions up to, and including, 0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

WordPress plugin WOW Entrance Effects (WEE!) 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress WOW Entrance Effects (WEE!) plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zakaria in WordPress Plugin WOW Entrance Effects WEE! versions = 0.1...

Vyper has a double eval in For List Iter

Multiple evaluation of a single expression is possible in the iterator target of a for loop. While the iterator expression cannot produce multiple writes, it can consume side effects produced in the loop body e.g. read a storage variable updated in the loop body and thus lead to unexpected progra...