CVE-2025-12473

CVE-2025-12473 refers to the RTMKit WordPress plugin (rometheme-for-elementor) with a Reflected Cross‑Site Scripting flaw via the themebuilder parameter in all versions up to 1.6.8. Documents confirm the vulnerability allows unauthenticated attackers to inject arbitrary scripts on pages executed ...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials in the JWKS resolver, which can be exposed if a fetch operation fails. An attacker can obtain private keys by forcing such a failure. Note: The keys are exposed even if RequestAuthentication is in use...

EUVD-2026-10933

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

GHSA-MHG6-2Q2V-9H2C sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

EUVD-2026-10932

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest...

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

EUVD-2026-10916

Sylius has a XSS vulnerability in checkout login form...

Sylius has a XSS vulnerability in checkout login form

Impact A cross-site scripting XSS vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any...

GHSA-VGH8-C6FP-7GCG Sylius has a XSS vulnerability in checkout login form

Impact A cross-site scripting XSS vulnerability exists in the shop checkout login form handled by the ApiLoginController Stimulus controller. When a login attempt fails, AuthenticationFailureHandler returns a JSON response whose message field is rendered into the DOM using innerHTML, allowing any...

The vulnerability of the hdm_probe component in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the hdmprobe component in the Linux operating system’s kernel is related to the use of an uninitialized resource. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of the iommufd component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the iommufd component in the Linux operating system’s kernel is related to the lack of checks for division by zero. Exploiting this vulnerability allows an attacker to cause a service failure...

The vulnerability of the virtio-net component in the Linux operating system, which allows a hacker to trigger a service failure

The vulnerability of the virtio-net component in the Linux operating system is related to pointer arithmetic errors. Exploiting this vulnerability allows an attacker to cause a service failure...

The vulnerability of the btusb_hci_drv_supported_altsettings() function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver allows a attacker to cause a service failure.

The vulnerability of the btusbhcidrvsupportedaltsettings function in the drivers/bluetooth/btusb.c module of the Linux Bluetooth device driver framework is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

sigstore-ruby verifier returns success for DSSE bundles with mismatched in-toto subject digest

Summary Sigstore::Verifierverify does not propagate the VerificationFailure returned by verifyintoto when the artifact digest does not match the digest in the in-toto attestation subject. As a result, verification of DSSE bundles containing in-toto statements returns VerificationSuccess regardles...

The vulnerability of the drm/tegra component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the drm/tegra component in the Linux operating system is related to the failure to release resources after the expiration of their useful life. Exploiting this vulnerability allows a perpetrator to cause service failures...

The vulnerability of the mtdchar component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the mtdchar component in the Linux operating system’s kernel is related to integer overflow. Exploiting this vulnerability allows an attacker to cause a service failure...

CVE-2025-67038

An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the...