CVE-2024-50615 affecting package tinyxml2 for versions less than 9.0.0-2

CVE-2024-50615 affecting package tinyxml2 for versions less than 9.0.0-2. A patched version of the package is available...

CVE-2024-36899 affecting package kernel for versions less than 5.15.179.1-1

CVE-2024-36899 affecting package kernel for versions less than 5.15.179.1-1. A patched version of the package is available...

PT-2025-19764 · Torch +2 · Torch +2

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: The issue concerns a voice changing framework based on VITS, where unsafe deserialization can occur. The ckpt a and cpkt b variables take user input, such as a...

PT-2025-19765 · Unknown · Retrieval-Based-Voice-Conversion-Webui

Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The issue arises from unsafe deserialization. The ckpt dir variable takes us...

CVE-2025-46554

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint...

CVE-2025-4210 Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgradi...

WordPress Ultimate Auction Pro plugin <= 1.5.2 - Unauthenticated SQL Injection via 'auction_id' vulnerability

Unauthenticated SQL Injection via 'auctionid' vulnerability discovered by Tom Broucke in WordPress Plugin Ultimate Auction Pro versions = 1.5.2...

WordPress FULL – Cliente plugin <= 3.1.25 - Authenticated (Subscriber+) SQL Injection

Authenticated Subscriber+ SQL Injection vulnerability discovered by kr0d in WordPress Plugin FULL Customer versions = 3.1.25...

WordPress Formality plugin <= 1.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via align Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Formality versions = 1.5.8...

GHSA-4PC9-X2FX-P7VJ @cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Summary The OAuth implementation failed to check that redirecturi was among the allowed set for the clientid. Impact Under certain circumstances see below, if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visitin...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...

WordPress WordPress Simple PayPal Shopping Cart plugin <= 5.1.3 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Jack Taylor in WordPress Plugin Simple Shopping Cart versions = 5.1.3...

CVE-2025-27611

CVE-2025-27611 is a base-x homograph attack affecting the base-x base encoder/decoder. The shared issue, present in versions 4.0.0, 5.0.0, and all prior to 3.0.11, can allow Unicode lookalike characters to bypass validation, potentially deceiving users into sending funds to an unintended address....

WordPress tagDiv Opt-In Builder plugin <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter vulnerability

Authenticated Subscriber+ SQL Injection via subscriptionCouponId Parameter vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Opt-In Builder versions = 1.7...

PT-2025-18199 · Vmsman · Vmsman

Name of the Vulnerable Software and Affected Versions: VMSMan up to 20250416 Description: A problem was found in the software. It affects some unknown functionality of the file /login.php. The issue can be exploited by manipulating the Email argument with the input "alert1, leading to cross-site...

Amazon Linux 2023 : redis6, redis6-devel (ALAS2023-2025-950)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-950 advisory. Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the serve...

CVE-2025-46326

snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition. When using the Easy Logging feature on Linux and macOS, the Connector reads logging configuration from a user-provided...

CVE-2025-4003 RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB. It has been classified as problematic. This affects the function InternalApfsTranslateBlock of the file Library/RPApfsLib/RPApfsIo.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the...

CVE-2025-4002

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is...

CVE-2025-0926

Gee-netics, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for a non-admin user to remove system files causing a boot loop by redirecting a file deletion when recording video. Axis has released a patched version for the highlighted flaw. Please refer to the Ax...