Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly limiting the scope of the cBPF program mitigation, which could lead to a BHB attack...

CVE-2025-39365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0...

CVE-2025-48232

CVE-2025-48232 describes a Stored XSS vulnerability in Xpro Addons For Beaver Builder – Lite. Connected sources specify that the issue affects Xpro Addons For Beaver Builder – Lite versions up to and including 1.5.5, caused by improper input neutralization during web page generation. The CVE is d...

CVE-2025-1531

The CVE-2025-1531 issue affects Hitachi Ops Center Analyzer viewpoint. Affected component: the viewpoint module of Hitachi Ops Center Analyzer (versions 10.0.0-00 through before 11.0.4-00). Root cause/result: authentication credentials leakage that can expose credentials. Impact: credential discl...

Commvault Command Center upload path traversal

Added: 05/16/2025 Background Commvault is a unified backup and recovery solution for cloud ready organizations. It gives complete backup and recovery protection for your business to cover all data wherever it resides. Problem A path traversal vulnerability allows unauthenticated users to upload...

CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution

The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block...

CVE-2025-4640

Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers. Since version 1.14.0, PCL by default uses a zlib installation from the system, unless the user sets WITHSYSTEMZLIB=FALSE. So this potential vulnerability is only relevant if the PCL version is older than 1.14.0 or...

CVE-2025-3909 JavaScript Execution via Spoofed PDF Attachment and file:/// Link

Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context. By crafting a nested email attachment message/rfc822 and setting its content type to application/pdf, Thunderbird may incorrectly render it as HTML when opened,...

CVE-2025-4430 Unauthorized file manipulation in EZD RP

Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 published on 22nd August 2024...

CVE-2025-31930

A vulnerability has been identified in IEC 1Ph 7.4kW Child socket 8EM1310-2EH04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Child socket/ shutter 8EM1310-2EN04-0GA0 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m 8EM1310-2EJ04-3GA1 All versions V2.135, IEC 1Ph 7.4kW Parent cable 7m incl. SIM...

CVE-2025-31930

Siemens VersiCharge AC Series EV Chargers are affected by CVE-2025-31930. The issue stems from Modbus service being enabled by default on affected devices, allowing an attacker connected to the same network to remotely control the charger. Affected models include IEC 1Ph/3Ph variants and UL/Versi...

CVE-2025-4632

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitrary file as system authority...

CVE-2025-47815

libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflateread called indirectly from zipmemberreadall in zip-reader.c...

CVE-2025-47451

Cross-Site Request Forgery CSRF vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a through = 1.2...

CVE-2025-37863

CVE-2025-37863 affects the Linux kernel overlayfs (ovl). The issue arises when a data-only layer is pointed to by an upper layer, something not currently used but previously allowed only via the datadir+ feature, which could trigger an Oops. The documented fix disables datadir without a lowerdir,...

CVE-2025-47643

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ELEXtensions ELEX Product Feed for WooCommerce allows SQL Injection. This issue affects ELEX Product Feed for WooCommerce: from n/a through 3.1.2...

CVE-2025-47605

CVE-2025-47605 describes a Stored XSS in the WordPress plugin WP jQuery DataTable (affected: WP jQuery DataTable

CVE-2025-47524 WordPress Quran multilanguage Text & Audio plugin <= 2.3.23 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in karim42 Quran multilanguage Text & Audio quran-text-multilanguage allows Stored XSS.This issue affects Quran multilanguage Text & Audio: from n/a through = 2.3.23...

CVE-2025-39361 WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through = 1.7.1017...

CVE-2025-0669

CVE-2025-0669 is a CSRF vulnerability in BOINC Server prior to version 1.4.3 . The flaw enables unauthorized state-changing requests over a network vector with low attack complexity and user interaction required . A PoC is referenced in advisories, and the impact is described as high for confiden...