CVE-2025-2009 Newsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting

The Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the logging functionality in all versions up to, and including, 4.9.9.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Medium: java-23-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

Splunk Enterprise 9.1.0 < 9.1.8, 9.2.0 < 9.2.5, 9.3.0 < 9.3.3, 9.4.0 < 9.4.1 (SVD-2025-0307)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-0307 advisory. - In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure...

OPENSUSE-SU-2025:14931-1 icingacli-2.12.4-1.1 on GA media

These are all security issues fixed in the icingacli-2.12.4-1.1 package on the GA media of openSUSE Tumbleweed...

Important: xorg-x11-server-Xwayland

Issue Overview: A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. CVE-2025-26594 A buffer overflow flaw was found ...

OPENSUSE-SU-2025:14932-1 qubesome-0.0.10-1.1 on GA media

These are all security issues fixed in the qubesome-0.0.10-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2025:14929-1 apache-commons-vfs2-2.10.0-1.1 on GA media

These are all security issues fixed in the apache-commons-vfs2-2.10.0-1.1 package on the GA media of openSUSE Tumbleweed...

Important: xorg-x11-server

Issue Overview: A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free. CVE-2025-26594 A buffer overflow flaw was found ...

openSUSE Security Advisory (SUSE-SU-2025:0989-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2025:14930-1 git-bug-0.8.0+git.1742269202.0ab94c9-1.1 on GA media

These are all security issues fixed in the git-bug-0.8.0+git.1742269202.0ab94c9-1.1 package on the GA media of openSUSE Tumbleweed...

GO-2025-3549 Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server

Mattermost Fails to Enforce Certain Search APIs in github.com/mattermost/mattermost-server...

K000150538: Kubernetes ingress-nginx vulnerabilities CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, and CVE-2025-24514

Security Advisory Description CVE-2025-1097 also known as IngressNightmare A security issue was discovered in ingress-nginx https : //github . com/kubernetes/ingress-nginx where the auth-tls-match-cn Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary cod...

CLSA-2025-1742924432 postgresql: Fix of CVE-2025-1094

CVE-2025-1094: fix potential SQL injections allowed by an improper encoding validation in data quoting functions - enable modules test...

CVE-2025-2754

A flaw was found in the Open Asset Import Library Assimp. The Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component is affected. This attack can be launched remotely, and manipulation of the argument can lead to a heap-bas...

Malicious code in zimu-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22290f844fd48d3682b9fff232fa6d8150d38d19a8553cafb8c7ed003ee0da4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13710

CVE-2024-13710 affects the WordPress plugin Estatebud – Properties & Listings. It is a Cross-Site Request Forgery vulnerability on the Estatebud_settings page that can let unauthenticated attackers update plugin settings by tricking an admin into performing an action. The issue affects all versio...

CVE-2025-27810

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays...

CVE-2024-13618

The aoa-downloadable WordPress plugin through 0.1.0 lacks authorization and authentication for requests to its download.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs...

OPENSUSE-SU-2025:14921-1 argocd-cli-2.14.8-1.1 on GA media

These are all security issues fixed in the argocd-cli-2.14.8-1.1 package on the GA media of openSUSE Tumbleweed...

Medium: golang

Issue Overview: net/http: sensitive headers incorrectly sent after cross-domain redirect The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to...