EUVD-2025-35901

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in versions less than, or equal to, 11.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Revive Adserver: Improper sanitisation of input in the settings could cause DoS

A vulnerability was found in the settings functionality of the application where attacker-controlled values in the emailfromName and emailfromCompany fields were persisted and later rendered to pages without proper output encoding. This could have led to the execution of arbitrary JavaScript in t...

CVE-2025-60419

An issue was discovered in the NDIS Usermode IO driver RtkIOAC60.sys, version 6.0.5600.16348 allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service...

OSV-2025-857 Global-buffer-overflow in void jxl::N_AVX2::WriteToOutputStage::StoreUnsignedRow<unsigned char>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=454749502 Crash type: Global-buffer-overflow READ 16 Crash state: void jxl::NAVX2::WriteToOutputStage::StoreUnsignedRow jxl::NAVX2::WriteToOutputStage::OutputBuffers jxl::NAVX2::WriteToOutputStage::ProcessRow...

WordPress plugin Time Clock 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripting...

Realtek RtkIOAC60.sys 安全漏洞

Realtek RtkIOAC60.sys is a driver from Realtek Semiconductor Realtek, a Chinese company. A security vulnerability exists in Realtek RtkIOAC60.sys version 6.0.5600.16348, which originates from a local authenticated attacker who can send a specially crafted IOCTL request that could result in a deni...

EUVD-2025-35892

An issue was discovered in the NDIS Usermode IO driver RtkIOAC60.sys, version 6.0.5600.16348 allowing local authenticated attackers to send a crafted IOCTL request to the driver to cause a denial of service...

CVE-2025-12017

The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

EUVD-2025-35818

The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2025-60419

CVE-2025-60419 affects Realtek’s NDIS Usermode IO driver RtkIOAC60.sys (v6.0.5600.16348). The issue allows a local authenticated attacker to send a crafted IOCTL to the driver to trigger a denial of service. Attack vector is LOCAL with LOW attack complexity and no privileges required, leading to ...

CVE-2025-8427

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘autoplay’ parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

CVE-2025-62393

A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details...

CVE-2025-10138

The This-or-That plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'thisorthat' shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

SUSE SLED15: libQt5Bootstrap-devel-static / libQt5Bootstrap-devel-static-32bit / etc (SUSE-SU-2025:3723-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:3723-1 advisory. Security issues fixed: - CVE-2025-5455: processing of malformed data in qDecodeDataUrl can trigg...

The vulnerability in Mozilla Firefox, Firefox ESR, and the email client Thunderbird arises from incorrect encoding or the concealment of output data, allowing attackers to perform cross-site scripting (XSS) attacks.

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to improper encoding or the concealment of output data. Exploiting these vulnerabilities allows a remote attacker to perform cross-site scripting attacks XSS...

CVE-2025-60280

Cross-Site Scripting XSS vulnerability in Bang Resto v1.0 could allow an attacker to inject malicious JavaScript code into the application's web pages. This vulnerability exists due to insufficient input sanitization or output encoding, allowing attacker-controlled input to be rendered directly i...

CVE-2023-53711

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we sti...

UBUNTU-CVE-2022-50570

In the Linux kernel, the following vulnerability has been resolved: platform/chrome: fix memory corruption in ioctl If "smem.bytes" is larger than the buffer size it leads to memory corruption...

CVE-2023-53711 NFS: Fix a potential data corruption

In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we sti...

CVE-2022-50570

CVE-2022-50570 involves memory corruption in the Linux kernel’s platform/chrome ioctl handling. The issue occurs when s_mem.bytes is larger than the destination buffer, leading to memory corruption. The vulnerability has been resolved by a fix in the ioctl path. The CVSS vector indicates a locall...