20533 matches found
CVE-2025-14783
CVE-2025-14783 affects WordPress Easy Digital Downloads (versions ≤ 3.6.2). Root cause: unvalidated redirect in the edd_redirect parameter during password-reset flow, enabling unauthenticated users to coax recipients into visiting malicious sites. Exploitation: a PoC exists on GitHub (ZeroEthical...
CVE-2025-14783 Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'eddredirect' parameter. This makes it possible for unauthenticated attackers to redirect...
SUSE CVE-2023-54225
In the Linux kernel, the following vulnerability has been resolved: net: ipa: only reset hashed tables when supported Last year, the code that manages GSI channel transactions switched from using spinlock-protected linked lists to using indexes into the ring buffer used for a channel. Recently,...
EulerOS Virtualization 2.13.1 : kernel (EulerOS-SA-2025-2623)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : x86/mce: Work around an erratum on fast string copy instructionsCVE-2022-49124 net: preserve skbendoffset in...
EulerOS Virtualization 2.13.0 : kernel (EulerOS-SA-2025-2609)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : x86/mce: Work around an erratum on fast string copy instructionsCVE-2022-49124 net: preserve skbendoffset in...
PT-2025-54286
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd redirect' parameter. This makes it possible for unauthenticated attackers to redirect...
WordPress Private Google Calendars plugin <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset vulnerability
Missing Authorization to Authenticated Subscriber+ Settings Reset vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin Private Google Calendars versions = 20250811...
CVE-2025-14783: Weak Password Recovery Mechanism for Forgotten Password
The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'eddredirect' parameter. This makes it possible for unauthenticated attackers to redirect...
WordPress CRM Memberships plugin <= 2.5 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint vulnerability
Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrmchangepassword' AJAX Endpoint vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin CRM Memberships versions = 2.5...
VulnCheck KEV: CVE-2025-10204
A vulnerability has been discovered in AC Smart II where passwords can be changed without authorization. This page contains a hidden form for resetting the administrator password. The attacker can manipulate the page using developer tools to display and use the form. This form allows you to chang...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993161)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993161 advisory. In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive lockin...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992808)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992808 advisory. In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pcibuslock One of the true positives that the cfgaccesslock...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-993114)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993114 advisory. In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free when reverting termination table When having multiple dests with...
Unity Linux 20.1060a Security Update: kernel (UTSA-2025-993202)
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-993202 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Fix hungtask for PADATARESET We found a hungtask bug in testaeadveccfg as...
WordPress Easy Digital Downloads plugin <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect vulnerability
Unvalidated Redirect in Password Reset Flow via eddredirect vulnerability discovered by shark3y in WordPress Plugin Easy Digital Downloads versions = 3.6.2...
EUVD-2023-60513
In the Linux kernel, the following vulnerability has been resolved: vduse: fix NULL pointer dereference vdusevdpasetvqaffinity callback can be called with NULL value as cpumask when deleting the vduse device. This patch resets virtqueue's IRQ affinity mask value to set all CPUs instead of...
EUVD-2023-60385
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2023-60465
In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcpworker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect // incoming reset + fastclose // the mptcp worker is...
EUVD-2022-55829
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds in rpage When PAGESIZE is 64K, if readlogpage is called by logreadrst for the first time, the size of buffer would be equal to DefaultLogPageSize4K.But for buffer operations like memcpy, if the...
