Astra Linux – Vulnerability in OpenSSL

Issue summary: An application that uses the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the ‘noproxy’ environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can cause a crash,...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

Update Chrome now: 20 security fixes just landed

Google has released an update for its Chrome browser that includes 20 security fixes, several of which are classed as high severity. Most of these flaws were found in Chrome’s V8 engine—the part of Chrome and other Chromium-based browsers that runs JavaScript. Chrome is by far the world’s most...

WordPress ERI File Library plugin <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download vulnerability

Missing Authorization to Unauthenticated Protected File Download vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin ERI File Library versions = 1.1.0...

WordPress The Events Calendar plugin <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure vulnerability

Missing Authorization to Authenticated Subscriber+ Draft Event Title/QR Code Exposure vulnerability discovered by Md. Moniruzzaman Prodhan NomanProdhan - Knight Squad in WordPress Plugin The Events Calendar versions = 6.15.9...

WordPress WooCommerce Designer Pro plugin <= 1.9.28 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by István Márton in WordPress Plugin WooCommerce Designer Pro versions = 1.9.28...

SUSE CVE-2025-12428

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2025-12431

Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: High...

openSUSE Security Advisory (SUSE-SU-2025:3859-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress Core <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software Qzzr Shortcode Type WordPress Core Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-11806 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8319539fe579 Credits zakaria Required...

WordPress Smart Coupons for WooCommerce plugin <= 2.2.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Smart Coupons for WooCommerce versions = 2.2.3...

WordPress Advanced Database Cleaner plugin <= 3.1.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Bao - BlueRock in WordPress Plugin Advanced Database Cleaner versions = 3.1.6...

WordPress NS Maintenance Mode for WP plugin <= 1.3.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin NS Maintenance Mode for WP versions = 1.3.1...

WordPress K Elements plugin < 5.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin K Elements versions 5.5.0...

WordPress Weglot Translate plugin <= 5.1 - Missing Authorization to Unauthenticated Limited Transient Deletion vulnerability

Missing Authorization to Unauthenticated Limited Transient Deletion vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Weglot Translate versions = 5.1...

WordPress SmartMag Theme <= 10.3.1 is vulnerable to Cross Site Scripting (XSS)

Software SmartMag Type Theme Vulnerable versions = 10.3.1 Fixed in 10.3.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2025-64204 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6a240fc7988d Credits João Pedro S Alcântara Kinorth Required...

WordPress Kleo Theme < 5.5.0 is vulnerable to Local File Inclusion

Software Kleo Type Theme Vulnerable versions 5.5.0 Fixed in 5.5.0 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2025-64363 Patch priority Low CVSS severity Low 7.5 Developer EPC PSID 1d3d5f3ae51e Credits João Pedro S Alcântara Kinorth Required privilege...

Moderate Photon OS Security Update - PHSA-2025-5.0-91-0663

Updates of 'binutils' packages of Photon OS have been released...

WordPress Masterstudy Theme < 4.8.126 is vulnerable to Local File Inclusion

Software Masterstudy Type Theme Vulnerable versions 4.8.126 Fixed in 4.8.126 OWASP Top 10 A1: Broken Access Control Classification Local File Inclusion CVE CVE-2025-64364 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID c61c79de05c6 Credits João Pedro S Alcântara Kinorth...

Fedora: Security Advisory (FEDORA-2025-92566203fd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...