CVE-2023-7088

CVE-2023-7088 affects the WordPress plugin Add SVG Support for Media Uploader (inventivo) up to version 1.0.5. The issue is that uploaded SVGs are not sanitized, allowing stored XSS via SVGs and enabling impact for users with as little as Author privileges. Publicly provided connected documents c...

CVE-2023-7086

The CVE-2023-7086 entry corresponds to the SVG Uploads Support WordPress plugin, affected up to version 2.1.1. The root cause is failure to sanitize uploaded SVG files, enabling stored XSS via SVG content (reported as exploitable by authors and higher). Public details in the provided documents co...

CVE-2023-6783

CVE-2023-6783 concerns the WolfNet IDX for WordPress plugin (

CVE-2023-6541

The CVE-2023-6541 entry concerns the WordPress Allow SVG plugin prior to 1.2.0, where uploaded SVGs are not sanitized, enabling stored XSS via SVG payloads uploaded by users with as little as Author privileges. Impact is cross-site scripting with low to moderate severity per sources; remediation:...

CVE-2023-5932

The CVE-2023-5932 issue concerns the WordPress plugin Travelpayouts: All Travel Brands in One Place, affected in versions prior to 1.1.14. The root cause is that a parameter is not properly sanitized/escaped before being echoed back in the page, enabling a Reflected Cross-Site Scripting (XSS) att...

CVE-2023-5934

CVE-2023-5934 affects the Travelpayouts WordPress plugin: versions prior to 1.1.13 lack CSRF protection when importing v1 settings, enabling a CSRF attack to modify settings by a logged-in admin. Documented PoC/exploitation paths exist (e.g., WPScan/patchstack references). Vulnerability context s...

CVE-2023-5529

Affected software: Advanced Page Visit Counter WordPress plugin, prior to version 8.0.6. Root cause: plugin does not sanitise/escape certain settings, enabling Stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (e.g., multisite). Impact: admin-level Stored X...

RaaS Explained: How Cybercriminals Are Scaling Attacks Like Startups

There is a lot of money in cyberattacks like ransomware, and unfortunately for organizations of all sizes, the…...

xorg: xwayland: Use-after-free in SyncInitTrigger()

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger is called. If one of the changes triggers an error, the function will return...

xorg: xwayland: Use-after-free in PlayReleasedEvents()

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free...

Ensure That Warning Banners Contain Proper Information

Warning banners contain warning information added on the system login page. Security warnings are displayed for all users who log in to the system. The security warnings must include information about the organization to which the system belongs, monitoring or records of login behavior, and legal...

Balancing Security and Liquidity: a Time-Weighted Snapshot Framework for DAO Governance Voting

As new project upgrading the blockchain industry, novel forms of attack challenges developers to rethink about the design of their innovations. In the growth stage of the development, Decentralized Autonomous Organizations DAO introduces different approaches in managing fund through voting in...

CVE-2022-21546

CVE-2022-21546 is a Linux kernel vulnerability affecting the SCSI target path. The issue arises in target_core_iblock/file when handling WRITE_SAME commands if the NDOB bit is set (NDOB indicates no data buffer) or when zero SG elements are sent. The kernel patch adds a common WRITE_SAME check fo...

[SECURITY] Fedora 41 Update: digikam-8.6.0-4.fc41

digiKam is an easy to use and powerful digital photo management application, which makes importing, organizing and manipulating digital photos a "snap". An easy to use interface is provided to connect to your digital camera, preview the images and download and/or delete them. digiKam built-in ima...

Malicious Package

Overview relative-ci-agent is a malicious package. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. The bin script in this package collects environment variables from process.env and sends the...

Lotus Panda Hacks SE Asian Governments With Browser Stealers and Sideloaded Malware

The China-linked cyber espionage group tracked as Lotus Panda has been attributed to a campaign that compromised multiple organizations in an unnamed Southeast Asian country between August 2024 and February 2025. "Targets included a government ministry, an air traffic control organization, a...

xorg: xwayland: Heap overflow in XkbWriteKeySyms()

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms differs from what is written in XkbWriteKeySyms, which may lead to a heap-based buffer overflow...

Following the News: MITRE’s Common Vulnerabilities and Exposures (CVE) Funding

The current situation On April 16, CISA extended funding to ensure no continuity issues with the critical Common Vulnerabilities and Exposures CVE program. This was in response to a letter sent by MITRE on April 15 to CVE board members warning of a potential issue with MITRE's support for the CVE...

Funding Expires for Key Cyber Vulnerability Database

A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to...

PT-2025-16904

Name of the Vulnerable Software and Affected Versions Zulip versions prior to 10.2 Description A bug in the Zulip server allows account creation without authenticating with the configured Single Sign-On SSO authentication backend in organizations where account creation is limited solely by SSO...