CVE-2025-2815 Administrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update

The Administrator Z plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the adminzimportbackup function in all versions up to, and including, 2025.03.24. This makes it possible for authenticated...

CVE-2025-1860

Data::Entropy for Perl 0.007 and earlier use the rand function as the default source of entropy, which is not cryptographically secure, for cryptographic functions. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

Malicious code in resolver-options (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68b3b87faef2aa88da0714f9641eef9b258d050775eb10ec9fac90abbae5d8b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin Administrator Z 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exis...

GHSA-RCW3-WMX7-CPHR Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter

Impact In vega 5.30.0 and lower, vega-functions 5.15.0 and lower , it was possible to call JavaScript functions from the Vega expression language that were not meant to be supported. Patches Patched in vega 5.31.0 / vega-functions 5.16.0 Workarounds Is there a way for users to fix or remediate th...

The vulnerability of the Linux operating system’s Bluetooth kernel component, which allows a hacker to trigger a service failure

The vulnerability of the rfcommsocksetsockoptold and rfcommsocksetsockopt functions of the Linux kernel’s Bluetooth component is related to read-off-bounds errors. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-27835

A flaw was found in Artifex Ghostscript. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

WordPress BWL Advanced FAQ Manager plugin <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update vulnerability

Missing Authorization to Authenticated Subscriber+ Limited Arbitrary Options Update vulnerability discovered by Lucio Sá in WordPress Plugin BWL Advanced FAQ Manager versions = 2.1.4...

CVE-2025-2754

A flaw was found in the Open Asset Import Library Assimp. The Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component is affected. This attack can be launched remotely, and manipulation of the argument can lead to a heap-bas...

CVE-2025-2756

A flaw was found in the Open Asset Import Library Assimp. This affects the Assimp::AC3DImporter::ConvertObjectSection function of the code/AssetLib/AC/ACLoader.cpp file in the AC3D File Handler component. The manipulation of the tmp argument can lead to a heap-based buffer overflow. It is possibl...

CVE-2025-2753

A flaw was found in the Open Asset Import Library Assimp. The SceneCombiner::MergeScenes function of the code/AssetLib/LWS/LWSLoader.cpp file in the LWS File Handler component is affected. It is possible to launch the attack remotely, and manipulation can lead to out-of-bounds read. Mitigation...

CVE-2025-2724

A flaw was found in the libgsf package, affecting the sortingkeycopy function. It is possible to launch the attack on the local host, and manipulation of the Name argument can lead to out-of-bounds read. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2025-2723

A flaw was found in the GNOME libgsf package, affecting the gsfpropertysettingscollec function. Manipulation of the nallocedparams argument can lead to a heap-based buffer overflow. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data due to the use of insecure Shiro options secureCookies=False and httpOnly=False. An attacker in a MitM position can access sensitive information in transit. Remediation There is no fixed version for...

Missing Encryption of Sensitive Data

Overview Affected versions of this package are vulnerable to Missing Encryption of Sensitive Data due to the use of insecure Shiro options secureCookies=False and httpOnly=False. An attacker in a MitM position can access sensitive information in transit. Remediation There is no fixed version for...

CVE-2024-13903

A flaw was found in QuickJS-ng. This vulnerability allows a stack-based buffer overflow via manipulation of the JSGetRuntime function in the quickjs.c file of the qjs component. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2025-2584

A flaw was found in WebAssembly wabt. This vulnerability allows a heap-based buffer overflow via a manipulated function. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and...

CVE-2025-0315

A flaw was found in Ollama. This vulnerability allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This can cause the server to allocate unlimited memory, leading to a denial of service DoS attack via specially crafted GGUF model files...

CVE-2025-0313

A flaw was found in Ollama. This vulnerability allows a malicious user to cause a denial of service DoS attack via improper validation of array index bounds in the GGUF model handling code, which can be exploited remotely over a network. Mitigation Mitigation for this issue is either not availabl...

CVE-2024-7598

A flaw was found in Kubernetes. This vulnerability can allow a malicious or compromised pod to bypass network restrictions via the deletion of network policies before pod termination during namespace deletion. Mitigation Mitigation for this issue is either not available or the currently available...