CVE-2025-8176

CVE-2025-8176 affects LibTIFF up to 4.7.0, with a use-after-free in the get_histogram implementation (tools/tiffmedian.c). Exploitation is local, and public exploits have been disclosed. A patch is available: fe10872e53efba9cc36c66ac4ab3b41a839d5172; apply the official patch/update to mitigate. R...

GHSA-P9QM-P942-Q3W5 XWiki Platform vulnerable to SQL injection through XWiki#searchDocuments API

Impact It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWikisearchDocuments APIs are not sanitizing the query at all and even if they force a specific select, Hibernate allows using any native function in an HQL query for example in the...

WordPress Timber plugin <= 1.23.1 - Use of a Vulnerable Dependency vulnerability

Use of a Vulnerable Dependency vulnerability discovered by WordFence in WordPress Plugin Timber versions = 1.23.1...

WordPress KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Theme <= 4.21.0 is vulnerable to Local File Inclusion

Software KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Type Theme Vulnerable versions = 4.21.0 Fixed in 4.22.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-6991 Patch priority Low CVSS severity Low 7.5 Developer EPC PSID 34bd1e68ee25 Credits stealthcopt...

GHSA-VR59-GM53-V7CQ XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter

Impact It's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. One can see the result of the injection with...

CVE-2025-53832

Lara Translate MCP Server is a Model Context Protocol MCP Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability which exists in the @translated/lara-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to...

Security Bulletin: Netty SslHandler Vulnerability Leads to Native Crash via Crafted Packet

Summary Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases which...

CVE-2025-54072

The CVE-2025-54072 entry concerns yt-dlp prior to version 2025.07.21 on Windows, where using --exec with the default placeholder or {} led to insufficient sanitization of the expanded filepath and could cause remote code execution. This effectively bypasses the mitigation from CVE-2024-22423. Aff...

CVE-2025-7865

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross...

CVE-2025-7953 Sanluan PublicCMS viewer.html redirect

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open...

CVE-2025-7953 Sanluan PublicCMS viewer.html redirect

A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the file publiccms-parent/publiccms/src/main/webapp/resource/plugins/pdfjs/viewer.html. The manipulation of the argument File leads to open...

SAP Netweaver Visual Composer Insecure Deserialization (3604119)

SAP NetWeaver Visual Composer is affected by an insecure deserialization vulnerability caused by insufficient validation of uploaded content, when deserialized, provided by a high-privileged user. This allows an attacker to potentially compromise the confidentiality, integrity, and availability o...

CVE-2025-7863

A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/main/java/com/jeesite/common/web/http/ServletUtils.java. The manipulation of the argument url leads to open redirect. The attack may be...

CVE-2025-7763

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-7797

GPAC up to 2.4 contains a vulnerable function gf_dash_download_init_segment in src/media_tools/dash_client.c where manipulation of base_init_url can cause a null pointer dereference. The vulnerability can be triggered remotely and the exploit has been disclosed publicly. A patch is available (153...

CVE-2025-23166 affecting package nodejs18 for versions less than 18.20.3-7

CVE-2025-23166 affecting package nodejs18 for versions less than 18.20.3-7. A patched version of the package is available...

WordPress LoginPress Pro plugin <= 5.0.1 - Authentication Bypass via WordPress.com OAuth provider vulnerability

Authentication Bypass via WordPress.com OAuth provider vulnerability discovered by Foxyyy in WordPress Plugin LoginPress Pro versions = 5.0.1...

CVE-2025-7763

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com/jeesite/modules/cms/web/SiteController.java of the component Site Controller. The manipulation of the argument redirect leads to open...

CVE-2025-7763 thinkgem JeeSite Site Controller/SSO redirect

A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is an unknown function of the component Site Controller/SSO. The manipulation leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the publ...

CVE-2025-7759 thinkgem JeeSite UEditor Image Grabber ActionEnter.java server-side request forgery

A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/common/ueditor/ActionEnter.java of the component UEditor Image Grabber. Such manipulation of the argument Source leads to server-side request...