GHSA-675F-RQ2R-JW82 JWK Set's HTTP client only overwrites and appends JWK to local cache during refresh

Impact The project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key...

PT-2025-4712 · Villatheme · Villatheme Advanced Product Information For Woocommerce

Name of the Vulnerable Software and Affected Versions: VillaTheme Advanced Product Information for WooCommerce versions 1.1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means...

PT-2025-4729 · Unknown · Storepress

Name of the Vulnerable Software and Affected Versions: StorePress versions 1.0.12 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts in...

PT-2025-1608 · WordPress · Postlists

Name of the Vulnerable Software and Affected Versions: PostLists WordPress plugin versions 2.0.2 and earlier Description: The issue is related to the PostLists WordPress plugin, which does not properly escape the $ SERVER'REQUEST URI' parameter before outputting it back in an attribute. This coul...

CVE-2024-45033

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-54676

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-54676

CVE-2024-54676 affects Apache OpenMeetings (2.1.0 up to 8.0.0, multiple entries across feeds). The issue is deserialization of untrusted data in cluster mode due to clustering instructions not specifying OpenJPA white/blacklists. Affected users are advised to upgrade to OpenMeetings 8.0.0 and to ...

CVE-2024-8002

A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to versi...

CVE-2024-8002

CVE-2024-8002 affects VIWIS LMS 9.11, specifically the File Upload component. The vulnerability arises from input handling of the filename argument, enabling cross-site scripting (XSS) via a remote attack. Remediation is to upgrade to VIWIS LMS 9.12, which addresses this issue. The available sour...

CVE-2024-8002 VIWIS LMS File Upload cross site scripting

A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to versi...

Mozilla Firefox ESR Security Update (mfsa_2025-03) - Windows

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

PT-2025-4293 · Unknown · Mzk-Dp300N

Name of the Vulnerable Software and Affected Versions: MZK-DP300N versions 1.05 and earlier Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the logged-in user's web browser when accessing a crafted URL, if an attacker logs in to the affected produc...

PT-2025-4440 · Unknown · Nik Chankov Autocompleter

Name of the Vulnerable Software and Affected Versions: Nik Chankov Autocompleter versions 1.3.5.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on ...

PT-2025-3698 · Siwx91X · Siwx91X

Name of the Vulnerable Software and Affected Versions: SiWx91x devices affected versions not specified Description: The issue is related to the SHA2/224 algorithm, which returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, causing a Denial of...

PT-2025-4412 · WordPress · Aipost Ai Wp Writer

Name of the Vulnerable Software and Affected Versions: AIpost AI WP Writer versions 3.8.4.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF problem, which allows an attacker to perform unauthorized actions on a user's account. This can be done by tricking the user into...

PT-2025-4501 · Unknown · Wpmu Prefill Post

Name of the Vulnerable Software and Affected Versions: WPMU Prefill Post versions n/a through 1.02 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially enabling...

PT-2025-3816 · Unknown · Code-Projects Online Book Shop

Name of the Vulnerable Software and Affected Versions: code-projects Online Book Shop version 1.0 Description: A critical issue has been found in the code-projects Online Book Shop, affecting an unknown part of the /booklist.php file. The manipulation of the subcatid argument leads to SQL...

PT-2025-3242 · Tips Tricks Hq · Compact Wp Audio Player

Name of the Vulnerable Software and Affected Versions: Tips and Tricks HQ Compact WP Audio Player versions 1.9.14 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability that allows Server Side Request Forgery. This means an attacker can potentially trick the server...

PT-2025-4294 · Unknown · Langchain4J-Aideepin

Name of the Vulnerable Software and Affected Versions: LangChain4j-AIDeepin versions prior to 3.5.0 Description: LangChain4j-AIDeepin is a Retrieval enhancement generation RAG project. Prior to version 3.5.0, it used MD5 to hash files, which may cause file upload conflicts. Recommendations: For...