WordPress Projectopia plugin <= 5.1.23 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Martino Spagnuolo r3verii in WordPress Plugin Projectopia versions = 5.1.23...

BIT-PYTHON-2024-8088 Infinite loop when iterating over zip archive entry names from zipfile.Path

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" class is unaffected. When iterating over names of entries in a zip archive for example, methods of "zipfile.Path" like "namelist", "iterdir", etc...

WordPress Eximius Theme <= 2.2 is vulnerable to Arbitrary File Upload

Software Eximius Type Theme Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Upload CVE CVE-2025-26872 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 7882f5b4cf65 Credits stealthcopter Required privilege...

WordPress Grip Theme <= 1.0.9 is vulnerable to Local File Inclusion

Software Grip Type Theme Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-26735 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID b5e4d6f7b083 Credits tahu.datar Required privilege Unauthenticated Publishe...

WordPress Celestial Aura Theme <= 2.2 is vulnerable to Arbitrary File Upload

Software Celestial Aura Type Theme Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Upload CVE CVE-2025-26892 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 6836679a2db2 Credits stealthcopter Required privilege...

GHSA-F87W-3J5W-V58P CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. Chromium security severity: High https://nvd.nist.gov/vuln/detail/CVE-2025-2783...

Advisory ROSA-SA-2025-2836

Software: dhcp 4.3.6 OS: ROSA Virtualization 2.1 packageevrstring: dhcp-4.3.6-50.0.1.rv3 CVE-ID: CVE-2023-50387 BDU-ID: 2024-01359 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the DNSSEC component of the DNS protocol implementation of the DNS server BIND is related to the algorithmic complexity a...

Advisory ROSA-SA-2025-2815

Software: binutils 2.30 OS: ROSA Virtualization 3.0 packageevrstring: binutils-2.30-125.rv30 CVE-ID: CVE-2018-12699 BDU-ID: 2021-01389 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the finishstab function of the stabs.c file of the Binutils program development kit is related to an operation...

Advisory ROSA-SA-2025-2816

Software: openssl 1.1.1k OS: ROSA Virtualization 3.0 packageevrstring: openssl-1.1.1k-14.0.2.rv30 CVE-ID: CVE-2024-5535 BDU-ID: 2024-06988 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the SSLselectnextproto function of the SSL toolkit for the TLS and SSL OpenSSL protocols is related to informatio...

Advisory ROSA-SA-2025-2787

Software: postgresql15 15.12 OS: rosa-server79 packageevrstring: postgresql15-15.12-1PGDG.res7 CVE-ID: CVE-2024-7348 BDU-ID: 2024-06153 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the pgdump utility of the PostgreSQL database management system is related to the dereferencing of a null pointer du...

WordPress WPC Admin Columns plugin 2.0.6-2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update vulnerability

Authenticated Subscriber+ Privilege Escalation via User Meta Update vulnerability discovered by kr0d in WordPress Plugin WPC Admin Columns versions 2.0.6-2.1.0...

WordPress Everest Forms plugin <= 3.1.1 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability discovered by kuaile in WordPress Plugin Everest Forms versions = 3.1.1...

WordPress Cost Calculator Builder plugin <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter vulnerability

Authenticated Subscriber+ SQL Injection via orderids Parameter vulnerability discovered by mikemyers in WordPress Plugin Cost Calculator Builder versions = 3.2.67...

WordPress Add Product Frontend for WooCommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability

Arbitrary Content Deletion vulnerability discovered by Mika in WordPress Plugin Add Product Frontend for WooCommerce versions = 1.0.8...

WordPress Coming Soon, Maintenance Mode plugin <= 1.1.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Coming Soon, Maintenance Mode versions = 1.1.1...

WordPress WooCommerce Loyal Customers plugin <= 2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin WooCommerce Loyal Customers versions = 2.6...

WordPress InstaWP Connect plugin <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion vulnerability

Unauthenticated Local PHP File Inclusion vulnerability discovered by Cheng Liu in WordPress Plugin InstaWP Connect versions = 0.1.0.85...

WordPress Ray Enterprise Translation plugin <= 1.7.0 - Local File Inclusion via CSRF Vulnerability

Local File Inclusion via CSRF Vulnerability discovered by astra.r3verii in WordPress Plugin Ray Enterprise Translation versions = 1.7.0...

WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by LVT-tholv2k in WordPress Plugin Paid Videochat Turnkey Site versions = 7.3.11...

WordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by theviper17 in WordPress Plugin Solace Extra versions = 1.3.1...