WordPress plugin Ultimate WP Mail has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Mail Subscribe List: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin WPFunnels has a SQL injection vulnerability in its Mail and Mint components.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin.... A SQL injection...

PT-2025-38868

Name of the Vulnerable Software and Affected Versions Richard Leishman Mail Subscribe List versions through 2.1.10 Description The software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means that malicious co...

PT-2025-38990

Name of the Vulnerable Software and Affected Versions Rustaurius Ultimate WP Mail versions through 1.3.8 Description The software contains a flaw related to improper input handling during web page generation, which can lead to Stored Cross-site Scripting XSS. This allows an attacker to inject...

CVE-2025-59689: Improper Neutralization of Special Elements used in a Command

Libraesva ESG 4.5 through 5.5.x before 5.5.7 allows command injection via a compressed e-mail attachment. For ESG 5.0 a fix has been released in 5.0.31. For ESG 5.1 a fix has been released in 5.1.20. For ESG 5.2 a fix has been released in 5.2.31. For ESG 5.4 a fix has been released in 5.4.8. For...

Security update for nginx

This update for nginx fixes the following issues: CVE-2025-53859: the server side may leak arbitrary bytes during the NGINX SMTP authentication process bsc1248070. CVE-2025-23419: session resumption can bypass client certificate authentication requirements using TLSv1.3 bsc1236851. Patch...

EulerOS 2.0 SP13 : ruby (EulerOS-SA-2025-2150)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Net::IMAP implements Internet Message Access Protocol IMAP client functionality in Ruby. Prior to versions 0.5.7, 0.4.20, 0.3.9, and 0.2.5, there is...

CVE-2025-10366

A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of the argument Email address causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be...

Stalwart security vulnerabilities

stalwart is a versatile mail and collaboration server open-sourced by Stalwart Labs. A security vulnerability exists in stalwart versions prior to 0.12.0 through 0.13.3, which stems from a memory exhaustion issue in the CalDAV implementation that could lead to a denial of service attack...

Linux Distros Unpatched Vulnerability : CVE-2023-5422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresu...

Linux Distros Unpatched Vulnerability : CVE-2021-37845

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session during the cleartext phase before a STARTTL...

Linux Distros Unpatched Vulnerability : CVE-2017-0420

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application...

Linux Distros Unpatched Vulnerability : CVE-2023-35169

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PHP-IMAP is a wrapper for common IMAP communication without the need to have the php-imap module installed / enabled. Prior to version 5.3.0, an unsanitized...

45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage

Threat hunters have discovered a set of previously unreported domains, some going back to May 2020, that are associated with China-linked threat actors Salt Typhoon and UNC4841. "The domains date back several years, with the oldest registration activity occurring in May 2020, further confirming...

45 Previously Unreported Domains Expose Longstanding Salt Typhoon Cyber Espionage

Threat hunters have discovered a set of previously unreported domains, some going back to May 2020, that are associated with China-linked threat actors Salt Typhoon and UNC4841. "The domains date back several years, with the oldest registration activity occurring in May 2020, further confirming...

RHEL 7 : firefox (RHSA-2025:15430)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2025:15430 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

CVE-2025-58822

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This issue affects WP Mail: from n/a through = 1.3...

Malicious npm Packages Impersonate Flashbots, Steal Ethereum Wallet Keys

A new set of four malicious packages have been discovered in the npm package registry with capabilities to steal cryptocurrency wallet credentials from Ethereum developers. "The packages masquerade as legitimate cryptographic utilities and Flashbots MEV infrastructure while secretly exfiltrating...

com.github.agourlay:cornichon-core_2.11 (>=0.12.7, <=0.14.3), com.github.agourlay:cornichon-experimental_2.11 (>=0.12.7, <=0.14.3) +37 more potentially affected by CVE-2025-58369 via co.fs2:fs2-io_2.11 (0.9.7)

co.fs2:fs2-io2.11 MAVEN version 0.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on co.fs2:fs2-io2.11 and may be impacted: - com.github.agourlay:cornichon-core2.11 =0.12.7, =0.12.7, =0.12.7, =0.14.1, =0.12.7, =2.2.0, =0.1.3, =0.1.0, =0.2.0, =0.1.1,...