CVE-2025-7810

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

PT-2025-31188 · WordPress +1 · Sky Addons For Elementor +1

Name of the Vulnerable Software and Affected Versions: Sky Addons for Elementor plugin versions up to and including 3.1.4 Description: The Sky Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting XSS through multiple widgets. Insufficient input sanitization and...

WordPress plugin Appzend 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin MetForm 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin StreamWeasels YouTube Integration 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...

DEBIAN-CVE-2025-38485

In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962affifoflush fxls8962affifoflush uses indiodev-activescanmask with iioforeachactivechannel without making sure the indiodev stays in buffer mode. There is a race if indiodev...

UBUNTU-CVE-2025-38484

In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write more characters, count is truncated to the max available space in "simplewritetobuffer". But afterwards a string terminator is written to t...

CVE-2025-38480

CVE-2025-38480 : In the Linux kernel's Comedi subsystem, insn_rw_emulate_bits() may read uninitialized data for INSN_READ/INSN_WRITE when insn->n is 0, causing an incorrect write to digital outputs and potentially corrupting channel state. The fix returns 0 early when insn->n == 0, aligning...

CVE-2025-38480 comedi: Fix use of uninitialized data in insn_rw_emulate_bits()

In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized data in insnrwemulatebits For Comedi INSNREAD and INSNWRITE instructions on "digital" subdevices subdevice types COMEDISUBDDI, COMEDISUBDDO, and COMEDISUBDDIO, it is common for the subdevice drive...

The vulnerability of the hid_bpfdestroy_device() function in the HID component of the Linux kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the hidbpfdestroydevice function in the HID component of the Linux kernel is related to improper elimination of certain elements in the output data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2025-6262

The muse.ai video embedding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's muse-ai shortcode in all versions up to, and including, 0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2025-54416

CVE-2025-54416 – tj-actions/branch-names has a concrete command-injection flaw in the GitHub Action outputs. The vulnerability stems from unsafe use of the pattern echo "... $(eval printf "%s" …)" to populate GITHUB_OUTPUT, allowing an attacker-controlled branch or tag name to inject commands dow...

branch-names 命令注入漏洞

branch-names is an open source tool from tj-actions for retrieving branch or tag names. A command injection vulnerability exists in branch-names version 8.2.1 and earlier, which stems from insufficient input cleanup and output escaping, and could lead to arbitrary command execution...

WordPress plugin Wonder Slider Lite 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin Advanced iFrame 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-3873

The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corruption on the host Cortex-M4 application. slsi91xaes slsi91xgcm slsi91xccm slsi91xsha...

CVE-2025-3873 Buffer overflow in Si91x crypto APIs

The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corruption on the host Cortex-M4 application. slsi91xaes slsi91xgcm slsi91xccm slsi91xsha...

PT-2025-30832

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to framebuffer relocation behind PCI bridges. The issue arises because framebuffer memory ranges in screen info are not updated when PCI host...

Silicon SiWx91x 安全漏洞

The Silicon SiWx91x is a radio board from Silicon Technology Silicon. A security vulnerability exists in the Silicon SiWx91x prior to version 3.4.0, which stems from the slsi91xaes, slsi91xgcm, slsi91xccm, and slsi91xsha APIs failing to check the size of the caller's output buffer, which could...

CLSA-2025-1753374522 libxml2: Fix of 2 CVEs

CVE-2025-49794: fix memory safety issues in xmlSchematronReportOutput when parsing XPath elements - CVE-2025-49796: fix memory corruption issue triggered by processing sch:name elements in input XML file...