PT-2025-9716

Name of the Vulnerable Software and Affected Versions conda-forge-metadata affected versions not specified Description The issue concerns the use of an optional dependency called conda-oci-mirror by conda-forge-metadata, which provides programmatic access to conda-forge's metadata. This dependenc...

GO-2025-3475 Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes

Hermes improperly validates a JWT in github.com/hashicorp-forge/hermes...

CVE-2025-22703

Cross-Site Request Forgery CSRF vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through = 1.4.6...

CVE-2022-39221

McWebserver mod runs a simple HTTP server alongside the Minecraft server in seperate threads. Path traversal in McWebserver Minecraft Mod for Fabric and Quilt up to and including 0.1.2.1 and McWebserver Minecraft Mod for Forge up to and including 0.1.1 allows all files, accessible by the program,...

CVE-2025-22703

Cross-Site Request Forgery CSRF vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through = 1.4.6...

CVE-2025-22703 WordPress Forge – Front-End Page Builder plugin <= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through = 1.4.6...

CVE-2025-22703

CVE-2025-22703 describes a CSRF to Stored XSS vulnerability in the WordPress plugin Forge – Front-End Page Builder (affected: versions up to and including 1.4.6). The vulnerability allows an attacker to induce a CSRF flow that results in stored cross-site scripting. CVSS 3.1 metrics indicate a HI...

CVE-2025-22703 WordPress Forge – Front-End Page Builder plugin <= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through = 1.4.6...

PT-2025-4636

Name of the Vulnerable Software and Affected Versions Forge – Front-End Page Builder versions prior to 1.4.7 Description The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a...

WordPress plugin Forge 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-22703: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in manuelvicedo Forge – Front-End Page Builder forge allows Stored XSS.This issue affects Forge – Front-End Page Builder: from n/a through = 1.4.6...

WordPress Forge – Front-End Page Builder plugin <= 1.4.6 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Forge – Front-End Page Builder versions = 1.4.6...

CVE-2024-55929: Insufficient Verification of Data Authenticity

A mail spoofing vulnerability in Xerox Workplace Suite allows attackers to forge email headers, making it appear as though messages are sent from trusted sources...

BIT-PHP-MIN-2020-7070 PHP parses encoded cookie names so malicious `__Host-` cookies can be sent

In PHP versions 7.2.x below 7.2.34, 7.3.x below 7.3.23 and 7.4.x below 7.4.11, when PHP is processing incoming HTTP cookie values, the cookie names are url-decoded. This may lead to cookies with prefixes like Host confused with cookies that decode to such prefix, thus leading to an attacker being...

IPv6-in-IPv4 tunneling 安全漏洞

IPv6-in-IPv4 tunneling is an IETF-organized basic conversion mechanism for IPv6 hosts and routers. A security vulnerability exists in IPv6-in-IPv4 tunneling that originates from an unauthenticated network packet source, which could allow an attacker to forge and route arbitrary traffic through an...

CVE-2025-23027

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027

CVE-2025-23027 affects the next-forge Next.js boilerplate. The root cause is a BASEHUB_TOKEN committed in apps/web/.env.example, exposing credentials and potentially granting unauthorized access if the token is active. Public references (NVD/Red Hat/OSV and others) describe the issue in terms of ...

CVE-2025-23027 BASEHUB_TOKEN commited in next-forge

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

next-forge 安全漏洞

next-forge is a production-grade Turborepo template for the Next.js application by Hayden Bleasel, an individual developer. A security vulnerability exists in versions prior to next-forge 3.0.11 that stems from the submission of BASEHUBTOKEN in the apps/web/.env.example file, which could lead to...