CVE-2019-25315: Improper Neutralization of Input During Web Page Generation

WordPress Server Log Viewer 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unfiltered log file paths. Attackers can add log files with embedded XSS payloads that will execute when viewed in the WordPress admin interface...

CVE-2019-25314: Undefined Security Weakness

Yoast Duplicate-Post WordPress Plugin 3.2.3 contains a persistent cross-site scripting vulnerability in plugin settings parameters. Attackers can inject malicious scripts into title prefix, suffix, menu order, and blacklist fields to execute arbitrary JavaScript in admin interfaces...

CVE-2019-25317: Improper Neutralization of Input During Web Page Generation

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users...

CVE-2025-15400: Missing Authorization

The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook...

CVE-2025-61732 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, tfsec, kargo, terraform-provider-sendgrid, maru, speedtest-go, src-fingerprint, docker-machine-driver-harvester, kuberlr, portieris, mongodb-kubernetes-operator, langfuse, cargobump, gostatsd, licenseclassifier, neuvector-dbgen, azuredisk-csi...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, tfsec, kargo, terraform-provider-sendgrid, maru, speedtest-go, src-fingerprint, docker-machine-driver-harvester, kuberlr, portieris, mongodb-kubernetes-operator, langfuse, gostatsd, neuvector-dbgen, azuredisk-csi, cluster-api, bank-vaults,...

GHSA-8JVR-VH7G-F8GX vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, velero-plugin-for-microsoft-azure-fips, mods, minio-object-browser, terraform-provider-time, tetragon, ucd, authservice, azure-service-operator, coredns, yace-fips, amazon-cloudwatch-agent-operator, gitness, age, flux-kustomize-controller,...

CVE-2025-68121 vulnerabilities

Vulnerabilities for packages: terraform-provider-azuread, mods, minio-object-browser, terraform-provider-time, tetragon, ucd, authservice, azure-service-operator, coredns, yace-fips, amazon-cloudwatch-agent-operator, gitness, flux-kustomize-controller, opensearch-k8s-operator, azcopy, witness,...

CVE-2026-2099 Flowring｜AgentFlow - Stored Cross-Site Scripting

AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load...

CVE-2026-0485

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

CVE-2026-0485

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

CVE-2026-0485

The CVE-2026-0485 entry relates to SAP BusinessObjects BI Platform where an unauthenticated attacker can send specially crafted requests that cause the Content Management Server (CMS) to crash and restart, leading to persistent unavailability. The impact is strictly on availability with confident...

PT-2026-7239

AgentFlow developed by Flowring has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load...

Flowring Agentflow Cross-Site Script Vulnerability

Flowring Agentflow is an intelligent process automation RPA platform developed by Flowring Corporation in China. Flowring Agentflow has a cross-site scripting vulnerability. This vulnerability stems from stored-xss scripts, which may allow authenticated remote attackers to inject persistent...

CVE-2026-0485: Asymmetric Resource Consumption (Amplification)

SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server CMS to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a persistent service disruption, renderin...

Intel Optane PMem management software code-related vulnerabilities

Intel Optane PMem management software is a persistent memory management software developed by Intel Corporation. Previous versions of Intel Optane PMem management software, such as CRMGMT02.00.00.4052 and CRMGMT03.00.00.0538, contained code vulnerabilities due to improper conditional checks, whic...

Intel® Optane™ PMem Management Software Advisory

Summary: Potential security vulnerabilities in the Intel® Optane™ Persistent Memory PMem management software may allow esclation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-22849 Description: Incorrect defau...

China-Linked UNC3886 Targets Singapore Telecom Sector in Cyber Espionage Campaign

The Cyber Security Agency CSA of Singapore on Monday revealed that the China-nexus cyber espionage group known as UNC3886 targeted its telecommunications sector. "UNC3886 had launched a deliberate, targeted, and well-planned campaign against Singapore's telecommunications sector," CSA said. "All...

Moderate: Red Hat Security Advisory: VolSync v0.13 security fixes and container updates

VolSync v0.13 General Availability release images, which provide enhancements, security fixes, and updated container images. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

Malicious code in @skyeng/libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b92505d9c0107026c2298d6ec8da504657990b61e40754b62b2cb8e1bd5a0b The package @skyeng/libs was found to contain malicious code. Source: ghsa-malware b4801b107979e502d4889dc729885a390ebfc2db995cd1b2fd23d27e09613a1b A...