CVE-2025-15663

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin (versions before 4.7.19 ) contains a Stored XSS vulnerability. The root cause is the failure to properly escape the slider's before-label value before a bundled client-side script re-injects it into the DOM . This allows users with...

EUVD-2025-210822

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15664 BEAF < 4.7.19 - Author+ Stored XSS via Before Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery WordPress plugin (versions before 4.7.19 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape the slider's after-label value before a bundled client-side script re-injects it into the DOM. Th...

EUVD-2025-210823

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

CVE-2025-15663 BEAF < 4.7.19 - Author+ Stored XSS via After Label

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

Security Bulletin: Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

Summary Multiple vulnerabilities in jackson-databind impact IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent. These vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION:...

bitbang-cli v0.5.0

BitBang CLI bitbang is a single static binary remote-access multitool. From any browser: an interactive shell and file browser access to the remote machine. You can also reach web apps on that machine's network. Beyond the browser, it does TCP port forwarding, file copy, and terminal sharing. It...

NetAlertX v26.9.0

NetAlertX - Network Visibility & Asset Intelligence Framework 📷 Click for more screenshots | | ---|---|--- | | | | Head to https://netalertx.com/ for even more gifs and screenshots 📷. NetAlertX is a network visibility and asset intelligence platform for homelabs, IT teams, MSPs, and distributed...

vault v2.1.0

Vault Please note : We take Vault's security and our users' trust very seriously. If you believe you have found a security issue in Vault, please responsibly disclose by contacting us at [email protected]. Website: developer.hashicorp.com/vault Announcement list: Google Groups Discussion...

GeoNetwork - Reflected Cross-Site Scripting

GeoNetwork versions 4.4.5 through 4.4.11 are vulnerable to reflected cross-site scripting XSS in the public unauthenticated catalog search functionality. The uiconfig query parameter of the catalog.search endpoint is reflected into a JavaScript context without sufficient sanitization, allowing...

SUSE CVE-2026-19953

URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host label but performs no Unicode normalization. IDNA requires a label to be normalized to Form C before it is encoded RFC 5891, so a label...

Security Bulletin: IBM QRadar SIEM contains components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verification only when enabled v...

SUSE CVE-2026-37236

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method i...

SUSE CVE-2026-83557

DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution only for a fixed set of "unsafe base types", and its isSafeSubType method returns true...

dbeaver v26.2.0

DBeaver Free multi-platform database tool for developers, SQL programmers, database administrators and analysts. Has a lot of features including schema editor, SQL editor, data editor, AI integration, ER diagrams, data export/import/migration, SQL execution plans, database administration tools,...

bromure agentic-coding-v4.6.0

Bromure Secure, ephemeral computing in disposable Linux VMs on macOS. → Full details, screenshots, and downloads at bromure.io This repo ships two sibling apps, both built on Apple's Virtualization.framework: Bromure — every browser session runs in a throwaway Linux VM. Close the window, the VM i...