CVE-2025-40292 affecting package kernel for versions less than 6.6.117.1-1

CVE-2025-40292 affecting package kernel for versions less than 6.6.117.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2025-14387

The CVE-2025-14387 entry concerns the LearnPress – WordPress LMS Plugin (WordPress) with versions up to 4.3.1. The vulnerability is a Stored Cross-Site Scripting flaw caused by insufficient input sanitization and output escaping. It can be exploited by authenticated attackers with Subscriber-leve...

EUVD-2025-203370

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'childpages' shortcode in all versions up to, and including, 2.0.0. This is due to insufficient input sanitization and output escaping on four user-supplied attributes usecustomlink, usecustomlinktarget,...

WordPress ekommart theme < 4.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme ekommart versions 4.3.1...

WordPress FAPI Member plugin <= 2.2.29 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by NumeX in WordPress Plugin FAPI Member versions = 2.2.29...

WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Urna versions = 2.5.12...

WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Visitor Statistics Real Time Traffic versions = 8.3...

WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin User Extra Fields versions = 16.8...

EUVD-2025-203347

LINE client for iOS prior to 15.4 allows man-in-the-middle attacks due to improper SSL/TLS certificate validation in an integrated financial SDK. The SDK interfered with the application's network processing, causing server certificate verification to be disabled for a significant portion of netwo...

CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...

VulnCheck KEV: CVE-2025-64764

Astro is a web framework. Prior to version 5.15.8, a reflected XSS vulnerability is present when the server islands feature is used in the targeted application, regardless of what was intended by the component templates. This issue has been patched in version 5.15.8...

UGREEN DH2100+ 安全漏洞

UGREEN DH2100+ is a private cloud storage device from China Greenlink UGREEN. A security vulnerability exists in UGREEN DH2100+ version 5.3.0 and earlier, which stems from a symbolic link following issue in the USB Handler component...

CentOS 9 : kernel-5.14.0-651.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-651.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in settrackprepare settrackprepare c...

PT-2025-51297

Name of the Vulnerable Software and Affected Versions NVClient version 5.0 Description NVClient 5.0 contains a stack buffer overflow in the user configuration contact field. An attacker can overwrite 846 bytes of memory by pasting a crafted payload into the contact box, leading to a denial of...

CVE-2025-65779

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value Boards.allow returns true without verifying userId, allowing arbitrary reordering of boards...

PT-2025-51323

Name of the Vulnerable Software and Affected Versions Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions 8.3.x and 9.3.0.x through 10.1.9.x Description The software deserializes untrusted JSON data without restricting the parser to approved classes and methods...

CVE-2025-67897

In Sequoia before 2.1.0, aeskeyunwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted message with a crafted PKESK or SKESK packet...

Sequoia PGP 安全漏洞

Sequoia PGP is a Rust library open-sourced by sequoia-pgp. A security vulnerability exists in Sequoia PGP versions prior to 2.1.0, which stems from the fact that aeskeyunwrap crashes when passing too short a ciphertext, potentially crashing the application...

PT-2025-51179

A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redirect. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 4.10.2 is...

CVE-2025-67749

PCSX2 is a free and open-source PlayStation 2 PS2 emulator. In versions 2.5.377 and below, an unchecked offset and size used in a memcpy operation inside PCSX2's CDVD SCMD 0x91 and SCMD 0x8F handlers allow a specially crafted disc image or ELF to cause an out-of-bounds read from emulator memory...