WordPress plugin The Pack Elementor addon 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

WordPress plugin WP Map Block 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...

SUSE CVE-2025-52889

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services DHCP, DNS... that partially bypass security options security.macfiltering, security.ipv4filtering and...

CVE-2013-1424

A buffer overflow flaw has been discovered in matplotlib. If exploited, this flaw allows an attacker to execute code in the context of the python program which uses matplotlib. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

OpenBao allows cancellation of root rekey and recovery rekey operations without authentication

Impact OpenBao and HashiCorp Vault allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. Patches In OpenBao v2.2.2 and later, manually setting the configuration option disableunauthedrekeyendpoints=true...

GHSA-P7FW-VJJM-2RWP Incus creates nftables rules that partially bypass security options

Summary When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options security.macfiltering, security.ipv4filtering and security.ipv6filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the...

Incus creates nftables rules that partially bypass security options

Summary When using an ACL on a device connected to a bridge, Incus generates nftables rules that partially bypass security options security.macfiltering, security.ipv4filtering and security.ipv6filtering. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the...

CVE-2025-52887

A denial-of-service vulnerability, stemming from memory exhaustion, has been identified in the cpp-httplib C++ HTTP/HTTPS library. This flaw is a result of the library's insufficient limits on the processing of HTTP headers. A remote attacker could exploit this by sending specially crafted HTTP...

CVE-2025-6703

A packet size handling flaw has been discovered in neqo-transport. If a server is prompted to send a packet larger than the maximum variant allowed, it will attempt to do so and panic, resulting in a program crash. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-6174

An access permissions flaw was found in cloud-init. When a non-x86 platform is detected, cloud-init grants root access to a hardcoded URL with a local IP address, which creates a security exposure. Mitigation Mitigation for this issue is either not available or the currently available options do...

CVE-2025-6442

A request smuggling vulnerability has been discovered in the Ruby WEBrick gem. This vulnerability is exploitable when the product is deployed behind a HTTP proxy that fulfills specific conditions. Mitigation Mitigation for this issue is either not available or the currently available options do n...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to SQL injection (CVE-2025-0966)

Summary A SQL injection vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-0966 DESCRIPTION: IBM InfoSphere Information Server vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the...

CVE-2025-52889

A DHCP pool management issue has been discovered in Incus. When using an ACL on a device connected to a bridge, a combination of nftables rules may cause available IP addresses to become exhausted. Mitigation Mitigation for this issue is either not available or the currently available options do...

CVE-2025-52999

A nested data handling flaw was found in Jackson Core. When parsing particularly deeply nested data structures, a StackoverflowError can occur. Mitigation To mitigate this vulnerability, the recommendation is to avoid parsing input files from untrusted sources that may have excessively deep neste...

CVE-2025-52890

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options security.macfiltering, security.ipv4filtering and security.ipv6filtering. This can lead to ARP...

Microsoft Extends Windows 10 Security Updates for One Year with New Enrollment Options

Microsoft on Tuesday announced that it's extending Windows 10 Extended Security Updates ESU for an extra year by letting users either pay a small fee of $30 or by sync their PC settings to the cloud. The development comes ahead of the tech giant's upcoming October 14, 2025, deadline, when it plan...

PT-2025-26863

Name of the Vulnerable Software and Affected Versions: Incus versions 6.12 and 6.13 Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, it generates nftables rules that partially bypass security options security.mac filtering,...

CVE-2025-52566

A flaw was found in the tokenizer component of llama.cpp. This vulnerability allows heap memory corruption via carefully crafted text input during tokenization, due to a signed vs. unsigned integer overflow in the llamavocab::tokenize function. Mitigation Mitigation for this issue is either not...

CVE-2025-6545

A flaw was found in the npm pbkdf2 library, allowing signature spoofing. When executing in javascript engines other than Nodejs or Nodejs when importing pbkdf2/browser, certain algorithms will silently fail and return invalid data. The return values are predictable, which undermines the security...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9.2.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...