Slackware Linux 15.0 / current vim Vulnerability (SSA:2025-361-01)

The version of vim installed on the remote host is prior to 9.1.2028. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-361-01 advisory. New vim packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding descriptio...

WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Brands for WooCommerce versions = 3.8.6.3...

WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contentstudio versions = 1.3.7...

Arbitrary Code Injection

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertconfig function. An attacker can execute arbitrary code by supplying a malicious checkpoint file that is process...

Arbitrary Code Injection

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertconfig function. An attacker can execute arbitrary code by supplying a malicious checkpoint file that is process...

Deserialization of Untrusted Data

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the parsing process of model files. An attacker can execute arbitrary code in the context of the current user by...

Deserialization of Untrusted Data

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the megatrongpt2 process. An attacker can achieve arbitrary code execution by tricking a user into opening a...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the parsing of attribute names. An attacker can execute arbitrary code in the context of the current user by enticing a user to open a malicious file or visit a malicious page that triggers the vulnerable...

Deserialization of Untrusted Data

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the parsing of model files. An attacker can execute arbitrary code by tricking a user into opening a specially...

Deserialization of Untrusted Data

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the parsing of checkpoints. An attacker can achieve arbitrary code execution by tricking a user into opening a...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the parsing of variable names due to insufficient validation of the length of user-supplied data before copying it into a fixed-length stack-based buffer. An attacker can achieve arbitrary code execution b...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the parsing of NC variables. An attacker can execute arbitrary code in the context of the current user by enticing a user to open a specially crafted file or visit a malicious page that triggers an...

Arbitrary Code Injection

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertconfig function. An attacker can execute arbitrary code by supplying a crafted checkpoint file that is processed...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the parsing of time units. An attacker can execute arbitrary code in the context of the current user by enticing a user to visit a malicious page or open a malicious file. Remediation There is no fixed...

CVE-2025-15033

A vulnerability in WooCommerce 8.1 to 10.4.2 can allow logged-in customers to access order data of guest customers on sites with a certain configuration. This has been fixed in WooCommerce 10.4.3, as well as all the previously affected versions through point releases, starting from 8.1, where it...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the MessageReceiver::procSubmsgDataFrag function. An attacker can cause the application to crash or become unresponsive by submitting specially crafted data that triggers an integer overflow. Remediati...

WordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Responsive Posts Carousel Pro versions = 15.2...

WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability

SQL Injection vulnerability discovered by benzdeus in WordPress Plugin WPBulky versions = 1.1.13...

WordPress Royal Elementor Addons and Templates plugin <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload vulnerability

Missing Authorization to Unauthenticated Media File Upload vulnerability discovered by Envel Le Clainche in WordPress Plugin Royal Elementor Addons versions = 1.7.1036...

Linux Distros Unpatched Vulnerability : CVE-2025-68469

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a...