CVE-2025-12905

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. Chromium security severity: Low...

OESA-2025-2637 python3 security update

Security Fixes: CPython 3.9 and earlier doesn't disallow configuring an empty list "" for SSLContext.setnpnprotocols which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used see CVE-2024-5535 for OpenSSL. This vulnerability is of low severity d...

PT-2025-45514

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 140.0.7339.80 Description A flaw exists in Google Chrome’s Downloads functionality on Windows. This issue allows a remote attacker to bypass the Mark of the Web security feature using a specially crafted HTML...

CVE-2025-11219

Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Low...

CVE-2025-11219

Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Low...

CVE-2025-11219

Use after free in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Chromium security severity: Low...

CVE-2025-11216

Inappropriate implementation in Storage in Google Chrome on Mac prior to 141.0.7390.54 allowed a remote attacker to perform domain spoofing via a crafted video file. Chromium security severity: Low...

WordPress Strong Testimonials plugin <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kishan Vyas in WordPress Plugin Strong Testimonials versions = 3.2.16...

WordPress Easy Email Subscription plugin <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion vulnerability

Cross-Site Request Forgery to Arbitrary Subscriber Deletion vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Easy Email Subscription versions = 1.3...

WordPress Ad Inserter plugin <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Custom Field vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Ad Inserter versions = 2.8.7...

WordPress FunnelKit Automations plugin <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Rafshanzani Suhada in WordPress Plugin FunnelKit Automations versions = 3.6.4.1...

WordPress Graphina plugin <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Chart Widgets vulnerability discovered by Webbernaut in WordPress Plugin Graphina versions = 3.1.8...

WordPress The Events Calendar plugin <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability

Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure vulnerability discovered by mikemyers in WordPress Plugin The Events Calendar versions = 6.15.9...

WordPress FunnelKit Automations plugin <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Email Sending vulnerability discovered by Rafshanzani Suhada in WordPress Plugin FunnelKit Automations versions = 3.6.4.1...

WordPress KiotViet Sync plugin <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass vulnerability

Use of Hard-coded Password to Authorization Bypass vulnerability discovered by kr0d in WordPress Plugin KiotViet Sync versions = 1.8.5...

WordPress Depicter Slider plugin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload vulnerability

Missing Authorization to Authenticated Contributor+ Safe File Type Upload vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Depicter Slider versions = 4.0.4...

WordPress Spectra plugin <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Custom CSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Spectra versions = 2.19.14...

Low: runc

Issue Overview: No CVE associated with this advisory Affected Packages: runc Issue Correction: Run dnf update runc --releasever 2023.9.20251105 or dnf update --advisory ALAS2023-2025-1263 --releasever 2023.9.20251105 to update your system. More information on how to update your system can be foun...

Drupal Features Module <= 0.0.2 is vulnerable to Broken Access Control

Software Features Type Module Vulnerable versions = 0.0.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2025-12582 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 2b7c0646055d Credits Nabil Irawan - Heroes Cyber Security...

WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by kr0d in WordPress Plugin Ai Auto Tool Content Writing Assistant Gemini Writer, ChatGPT All in One versions = 2.3.0...