31209 matches found
GitLab 13.12 < 17.8.7 / 17.9 < 17.9.6 / 17.10 < 17.10.4 (CVE-2025-2408)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditions users could bypass IP access...
100,000 WordPress Sites Affected by Administrative User Creation Vulnerability in SureTriggers WordPress Plugin
📢Did you know Wordfence runs aBug Bounty Program for all WordPress plugins and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...
CVE-2025-32379
Koa is expressive middleware for Node.js using ES2017 async functions. In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. This issue is patched in 2.16.1 and 3.0.0-alpha.5...
WordPress ALD Login Page plugin <= 1.1 - CSRF to Stored XSS vulnerability
CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin ALD Login Page versions = 1.1...
CVE-2025-32379
CVE-2025-32379 (Koa, Node.js): In koa < 2.16.1 and
CVE-2025-1632 affecting package libarchive for versions less than 3.7.7-2
CVE-2025-1632 affecting package libarchive for versions less than 3.7.7-2. A patched version of the package is available...
GHSA-X2RG-Q646-7M2V Koajs vulnerable to Cross-Site Scripting (XSS) at ctx.redirect() function
Summary In koa 2.16.1 and 3.0.0-alpha.5, passing untrusted user input to ctx.redirect even after sanitizing it, may execute javascript code on the user who use the app. Patches This issue is patched in 2.16.1 and 3.0.0-alpha.5. PoC Coming soon... Impact 1. Redirect user to another phishing site 2...
PT-2025-15868 · Unknown · Codeastro Internet Banking System
Name of the Vulnerable Software and Affected Versions: Code Astro Internet Banking System version 2.0.0 Description: A Stored Cross-Site Scripting XSS issue exists in the name parameter of pages add acc type.php in the Code Astro Internet Banking System. This allows for malicious script execution...
PT-2025-15755
Name of the Vulnerable Software and Affected Versions: Koa versions prior to 2.16.1 Koa versions prior to 3.0.0-alpha.5 Description: The issue arises when passing untrusted user input to ctx.redirect, which can execute JavaScript code on the user's device, even after sanitizing the input...
Slackware Linux 15.0 python3 Vulnerability (SSA:2025-099-01)
The version of python3 installed on the remote host is prior to 3.9.22. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-099-01 advisory. New python3 packages are available for Slackware 15.0 to fix security issues. Tenable has extracted the preceding description block...
CBL Mariner 2.0 Security Update: coredns / ig / keda (CVE-2025-29786)
The version of coredns / ig / keda installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-29786 advisory. - Expr is an expression language and expression evaluation for Go. Prior to version 1.17.0, if th...
CVE-2025-32035 DNN does not check the contents of a file when uploading files
DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 9.13.2, when uploading files e.g. when uploading assets, the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This...
2025-04 .NET 9.0.4 Security Update for x64 Client (KB5056687)
2025-04 .NET 9.0.4 Security Update for x64 Client KB5056687...
Shopware Broken ACL on Document retrieval to access other customers documents
Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers Patches Update to Shopware 6.6.10.3 or 6.5.8.17 Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend...
CVE-2025-32018
Cursor is an AI-codeditor. Versions 0.45.0–0.48.6 contain a regression that broadens the Cursor Agent’s file-modification permissions, allowing, under deliberate prompting (user or crafted context), automatic writes to files outside the opened workspace. The vulnerability can manifest when the ag...
CVE-2025-30151 Shopware allows Denial Of Service via password length
Shopware is an open commerce platform. It's possible to pass long passwords that leads to Denial Of Service via forms in Storefront forms or Store-API. This vulnerability is fixed in 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin...
Security update for procps
This update for procps fixes the following issues: Fixed regression introduced with the CVE-2023-4016 fix. The ps command segfaults when pid argument has a leading space bsc1236842. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...
Security update for giflib
This update for giflib fixes the following issues: CVE-2025-31344: Fixed a buffer overflow in function DumpScreen2RGB bsc1240416 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...
Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities
Google has shipped patches for 62 vulnerabilities, two of which it said have been exploited in the wild. The two high-severity vulnerabilities are listed below - CVE-2024-53150 CVSS score: 7.8 - An out-of-bounds flaw in the USB sub-component of Kernel that could result in information disclosure...
PT-2025-15898 · Packagist · Shopware/Core +1
Impact It's possible to guess the deepLinkCode of an Document to open documents of other customers Patches Update to Shopware 6.6.10.3 or 6.5.8.17 Workarounds For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend...