CVE-2025-58173 FreshRSS vulnerable to authenticated RCE via path traversal inside include()

FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the language user configuration parameter, it's possible to call install.php and perform various administrative actions as an unprivileged user. These actions include logging in as the...

CVE-2025-14019

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks...

PT-2025-51321

Name of the Vulnerable Software and Affected Versions FreshRSS versions 1.23.0 through 1.27.0 Description FreshRSS is a self-hosted RSS feed aggregator. Versions 1.23.0 through 1.27.0 contain a path traversal issue within the language user configuration parameter. This allows an unprivileged user...

CVE-2025-9218

The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorization in the handlerestpredispatch function when the Godam plugin is active, in versions 4.7.0 to 4.7.3. This makes it possible for unauthenticated attackers to...

Denial Of Service (DoS)

Starlette is vulnerable to Denial Of Service DoS. The vulnerability is due to quadratic-time processing in the FileResponse HTTP Range header parsing and merging logic, which allows an unauthenticated attacker to send a crafted Range header to exhaust CPU resources...

WordPress plugin rtMedia for WordPress, BuddyPress, and bbPress has security vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a suite of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

EUVD-2025-203121

Vuetify has a Prototype Pollution vulnerability...

Vuetify has a Prototype Pollution vulnerability

The Preset configuration feature of Vuetify is vulnerable to Prototype Pollution due to the internal 'mergeDeep' utility function used to merge options with defaults. Using a specially-crafted, malicious preset can result in polluting all JavaScript objects with arbitrary properties, which can...

EUVD-2025-203124

Vuetify has a Cross-site Scripting XSS vulnerability in the VDatePicker component...

CVE-2025-8083

The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/PrototypePollutionPreventionCheatSheet.html due to the internal 'mergeDeep' utility function used to merge options with...

CVE-2025-13211

IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency...

CVE-2025-8083

Vuetify CVE-2025-8083 is a Prototype Pollution flaw in the Preset configuration feature via internal mergeDeep when merging malicious presets. Affected: Vuetify >=2.2.0-beta.2 and

CVE-2025-8083 Vuetify Prototype Pollution via Preset options

The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp.org/cheatsheets/PrototypePollutionPreventionCheatSheet.html due to the internal 'mergeDeep' utility function used to merge options with...

Security update for gegl

This update for gegl fixes the following issues: CVE-2025-10921: Fixed HDR file parsing heap-based buffer overflow that can lead to remote code execution. bsc1250496 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2025:4382-1 Security update for gegl

This update for gegl fixes the following issues: - CVE-2025-10921: Fixed HDR file parsing heap-based buffer overflow that can lead to remote code execution. bsc1250496...

CVE-2025-13506 Improper Authorization in Nebim Neyir's Nebim V3 ERP

Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating System from the Database. This issue affects Nebim V3 ERP: from 2.0.59 before 3.0.1...

PT-2025-50927

Name of the Vulnerable Software and Affected Versions Nebim V3 ERP versions 2.0.59 through 3.0.0 Description An issue exists in Nebim V3 ERP that allows expanding control over the operating system from the database due to unnecessary privileges. Recommendations Update to a version later than 3.0....

PT-2025-50969

Name of the Vulnerable Software and Affected Versions Vuetify versions 2.2.0-beta.2 through 3.0.0-alpha.10 Description The Preset configuration feature of Vuetify is susceptible to Prototype Pollution due to the 'mergeDeep' utility function used for merging options with defaults. A specially...

CVE-2025-13314: Missing Authorization

The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.1.6 due to a missing capability check on the 'filtersavesettings' and 'addfilteroptions' AJAX action...

Nebim V3 ERP security vulnerabilities

Nebim V3 ERP is an enterprise resource planning system from Nebim Turkey. A security vulnerability exists in Nebim V3 ERP version 2.0.59 up to and including version 3.0.1, which originates from performing an unnecessarily privileged operation that could result in an extension of operating system...