Exploit for Path Traversal in Nevma Adaptive_Images

CVE-2019-14206 - Adaptive Images for WordPress Arbitrary File...

[SECURITY] Fedora 42 Update: nginx-1.28.1-1.fc42

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

[SECURITY] Fedora 43 Update: nginx-1.28.1-1.fc43

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability

Software : VidMov Type : Theme Vulnerable versions : = 2.3.8 Fixed in : 2.3.9 OWASP Top 10 : A1: Broken Access Control Classification : Path Traversal CVE ID : CVE-2025-67914 Patchstack priority : High CVSS severity : 7.7 Required privilege : Subscriber Developer : Claim ownership PSID :...

CVE-2025-13456

The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2026-1065

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions up to 2.2.0 Description A security issue exists in parisneo/lollms that allows any authenticated user to accept or reject friend requests belonging to other users. The respond request function within...

PT-2026-1064

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 2.2.0 Description A Server-Side Request Forgery SSRF issue exists in the /api/files/export-content endpoint. The download image to temp function in backend/routers/files.py does not properly validate...

PT-2026-1063

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions through 2.2.0 Description An issue exists in parisneo/lollms that allows unauthenticated users to upload and process files. The /api/files/extract-text endpoint does not require authentication, unlike other file-relate...

WordPress Issabella theme <= 1.1.2 - Local File Inclusion vulnerability

Software : Issabella Type : Theme Vulnerable versions : = 1.1.2 OWASP Top 10 : A3: Injection Classification : Local File Inclusion CVE ID : CVE-2025-69086 Patchstack priority : High CVSS severity : 8.1 Required privilege : Unauthenticated Developer : Claim ownership PSID : 1e3ff6a668aa Credits :...

WordPress Frappé theme <= 1.8 - Local File Inclusion vulnerability

Software : Frappé Type : Theme Vulnerable versions : = 1.8 OWASP Top 10 : A3: Injection Classification : Local File Inclusion CVE ID : CVE-2025-69083 Patchstack priority : High CVSS severity : 8.1 Required privilege : Unauthenticated Developer : Claim ownership PSID : 5c47b6166cd2 Credits : Tran...

EUVD-2025-206133

A high-severity remote code execution vulnerability exists in feast-dev/feast version 0.53.0, specifically in the Kubernetes materializer job located at feast/sdk/python/feast/infra/computeengines/kubernetes/main.py. The vulnerability arises from the use of yaml.load..., Loader=yaml.Loader to...

CVE-2025-15017

A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device can directly connect to the UART interface and, without authentication, user interaction, or execution conditions, gain unauthorized access...

WordPress Comments - wpDiscuz plugin < 7.6.40 - Unauthenticated Account Takeover vulnerability

WordPress Comments - wpDiscuz plugin 7.6.40 - Unauthenticated Account Takeover vulnerability discovered by wcraft in WordPress Plugin wpDiscuz versions 7.6.40...

EUVD-2025-206105

A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthController.php of the component Token Handler. Such manipulation leads to weak password recovery. The attack can be executed remotely. This attack...

PT-2026-3704

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4 Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. A high-privileged attacker with access to the infrastructure where Orac...

PT-2026-3735

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4 Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. A high-privileged attacker with access to the infrastructure where Orac...

PT-2026-27643

Name of the Vulnerable Software and Affected Versions Kea versions 2.6.0 through 2.6.4 Kea versions 3.0.0 through 3.0.2 Description A specially crafted message sent to the kea-ctrl-agent, kea-dhcp-ddns, kea-dhcp4, or kea-dhcp6 daemons via an API socket or HA listener can lead to a stack overflow...

PT-2026-34168

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.6 Description An issue in the Core component of Oracle VM VirtualBox allows a high privileged attacker with logon access to the infrastructure where the software executes to compromise the system. Successful...

PT-2026-3734

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox versions 7.1.14 and 7.2.4 Description An easily exploitable issue exists in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. A high-privileged attacker with access to the infrastructure where Orac...

PT-2026-7641

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 145.0.7632.45 Description A flaw exists in the WebGPU implementation of Google Chrome. This issue could allow a remote attacker to potentially access memory outside of the intended boundaries. This can occur...