CVE-2024-5647 Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library version 1.1.0 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

AlmaLinux 9 : gstreamer1-plugins-good (ALSA-2025:7242)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7242 advisory. gstreamer1-plugins-good: OOB-read in qtdemuxparsecontainer CVE-2024-47543 gstreamer1-plugins-good: GStreamer has an OOB-read in gstavisubtitleparsegab2chu...

PT-2025-27796 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress plugins affected versions not specified Description: The issue is related to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library. Insufficient input sanitization and output escaping on user-supplied...

WordPress’s various products have cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerabilit...

CVE-2025-2540: Improper Neutralization of Input During Web Page Generation

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library version 3.1.6 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

AlmaLinux 9 : gstreamer1-plugins-base (ALSA-2025:7243)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:7243 advisory. gstreamer1-plugins-base: ID3v2 parser out-of-bounds read and NULL-pointer dereference CVE-2024-47542 gstreamer1-plugins-base: GStreamer has an out-of-boun...

Important: Red Hat Security Advisory: Red Hat Developer Hub 1.6.2 release.

Red Hat Developer Hub 1.6.2 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...

CVE-2025-53206

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through = 1.0....

CVE-2025-53199

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through = 1.6.5...

CLSA-2025-1751142388 grafana: Fix of CVE-2022-31130

CVE-2022-31130: fix potential leak of authentication tokens to plugins...

CLSA-2025-1751141865 gstreamer1-plugins-base: Fix of CVE-2023-37328

CVE-2023-37328: fix subrip tag parsing to prevent out-of-bounds access in gstsubparse...

CLSA-2025-1751141320 gstreamer1-plugins-good: Fix of CVE-2024-47613

CVE-2024-47613: fix integer overflow in available data check for image tags...

CVE-2025-6776

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

CVE-2025-53206 WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through = 1.0....

SUSE SLES15: gstreamer-plugins-base / gstreamer-plugins-base-devel / etc (SUSE-SU-2025:02020-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02020-1 advisory. - CVE-2024-47538: Fixed stack-buffer overflow in vorbishandleidentificationpacket bnc1234415 - CVE-2024-47600: Fixed out-of-bounds...

gstreamer1-plugins-bad-free security update

1.24.11-2 - fix for CVE-2025-3887 Resolves: RHEL-93045...

CVE-2025-6776: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability classified as critical was found in xiaoyunjie openvpn-cms-flask up to 1.2.7. This vulnerability affects the function Upload of the file app/plugins/oss/app/controller.py of the component File Upload. The manipulation of the argument image leads to path traversal. The attack can b...

Oracle Linux 10 : gstreamer1-plugins-bad-free (ELSA-2025-8184)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8184 advisory. 1.24.11-2 - fix for CVE-2025-3887 Resolves: RHEL-93045 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory...

SUSE SLES15 Security Update : gstreamer-plugins-good (SUSE-SU-2025:02053-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02053-1 advisory. - CVE-2025-47183: Fixed out-of-bounds read in MOV/MP4 demuxer bsc1244406. - CVE-2025-47219: Fixed out-of-bounds read in MOV/MP4...