CLSA-2025-1759246699 python3: Fix of CVE-2025-8194

CVE-2025-8194: tarfile: validate archives to ensure non-negative member offsets...

CVE-2025-9991

The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2025-6724

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command...

CVE-2025-8777 planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter

The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-8777 planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter

The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-8777

The CVE-2025-8777 entry concerns the WordPress planetcalc plugin (versions

CVE-2025-9991 Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion

The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2025-9991

CVE-2025-9991 – The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to an unauthenticated Local File Inclusion via the language parameter in versions up to and including 4.3.34. The issue allows an attacker to include and execute arbitrary PHP files on the server, potentially byp...

CVE-2025-9993 Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion

The Bei Fen – WordPress Backup Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.2 via the 'task'. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...

Better Privilege Separation for Agents by Restricting Data Types

Large language models LLMs have become increasingly popular due to their ability to interact with unstructured content. As such, LLMs are now a key driver behind the automation of language processing systems, such as AI agents. Unfortunately, these advantages have come with a vulnerability to...

Red Teaming Program Repair Agents: When Correct Patches Can Hide Vulnerabilities

LLM-based agents are increasingly deployed for software maintenance tasks such as automated program repair APR. APR agents automatically fetch GitHub issues and use backend LLMs to generate patches that fix the reported bugs. However, existing work primarily focuses on the functional correctness ...

NVIDIA Delegated Licensing Service 安全漏洞

NVIDIA Delegated Licensing Service is a licensing service from NVIDIA Corporation. A security vulnerability exists in NVIDIA Delegated Licensing Service, which stems from vulnerability to SQL injection attacks that could lead to a partial denial of service...

MinIO Java SDK 代码注入漏洞

MinIO Java SDK is an open source developer tool for MinIO Client for Java by MinIO. A code injection vulnerability exists in versions of MinIO Java SDK prior to 8.6.0, which stems from the automatic substitution of XML tagged values for system properties or environment variables, which could lead...

PT-2025-39946

Name of the Vulnerable Software and Affected Versions planetcalc plugin for WordPress versions up to and including 2.2 Description The planetcalc plugin for WordPress is susceptible to Stored Cross-Site Scripting through the language parameter. Insufficient input sanitization and output escaping...

NewStart CGSL MAIN 6.06 : tcl Vulnerability (NS-SA-2025-0225)

The remote NewStart CGSL host, running version MAIN 6.06, has tcl packages installed that are affected by a vulnerability: - The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows...

PT-2025-39951

Name of the Vulnerable Software and Affected Versions Tiny Bootstrap Elements Light versions through 4.3.34 Description The Tiny Bootstrap Elements Light plugin for WordPress is susceptible to a Local File Inclusion issue via the language parameter. This allows unauthenticated attackers to includ...

WordPress plugin Tiny Bootstrap Elements Light 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

ROS-20250930-03

The polkit service vulnerability is related to a boundary validation error when processing XML policies with a nesting depth of 32 or more elements. of 32 or more elements. Exploitation of the vulnerability could allow an attacker to compromise a compromised vulnerable system...

CHAI: Command Hijacking against Embodied AI

Embodied Artificial Intelligence AI promises to handle edge cases in robotic vehicle systems where data is scarce by using common-sense reasoning grounded in perception and action to generalize beyond training distributions and adapt to novel real-world situations. These capabilities, however, al...

PT-2025-39990

Name of the Vulnerable Software and Affected Versions Frappe ErpNext version 15.57.5 Description The get income account function at erpnext/controllers/queries.py is susceptible to SQL Injection. An attacker can inject a SQL query into the filters.disabled parameter, potentially allowing extracti...