WordPress Ovatheme Events Manager plugin <= 1.8.5 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Plugin Ovatheme Events Manager versions = 1.8.5...

WordPress Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin <= 27.0.3 - Unauthenticated CSV Injection vulnerability

Unauthenticated CSV Injection vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin Contest Gallery versions = 27.0.3...

WordPress WPC Smart Wishlist for WooCommerce plugin <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation vulnerability

Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation vulnerability discovered by Athiwat Tiprasaharn Jitlada in WordPress Plugin WPC Smart Wishlist for WooCommerce versions = 5.0.3...

WordPress Trinity Audio plugin <= 5.21.0 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Moose Love in WordPress Plugin Trinity Audio versions = 5.21.0...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.1.6 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by dutafi in WordPress Plugin NEX-Forms versions = 9.1.6...

WordPress My Auctions Allegro plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection vulnerability

Authenticated Admin+ SQL Injection vulnerability discovered by tmrswrr in WordPress Plugin My auctions allegro versions = 3.6.31...

CVE-2025-9552 Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102

Vulnerability in Drupal Synchronize composer.Json With Contrib Modules.This issue affects Synchronize composer.Json With Contrib Modules:...

CVE-2025-9552

CVE-2025-9552 concerns the Drupal module Synchronize composer.Json With Contrib Modules . Public descriptions in connected documents indicate a vulnerability affecting the module in general (versions not specified). The NVD/NVD-derived metrics show a CVSS 3.1 base score of 5.3 (Medium) with an at...

Exploit for CVE-2025-60374

CVE-2025-60374 CVE-2025-60374: Stored Cross-Site Scripting XS...

PT-2025-41628

🟠 Liferay Portal, Cross-Site Scripting, CVE-2025-45104 Moderate https://t.co/UO81horKjh...

PT-2025-41601

Name of the Vulnerable Software and Affected Versions Emlog Pro versions 2.5.19 and earlier Description Emlog Pro versions 2.5.19 and earlier are susceptible to a Cross-Site Request Forgery CSRF issue on the password change endpoint. This allows an attacker to trick a logged-in administrator into...

WordPress WP JobHunt plugin <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’ vulnerability

Authenticated Candidate+ Stored Cross-Site Scripting via ‘csjobtitle’ vulnerability discovered by meghnine islem in WordPress Plugin WP JobHunt versions = 7.6...

WordPress Slider Revolution plugin <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary File Read vulnerability discovered by stealthcopter in WordPress Plugin Slider Revolution versions = 6.7.37...

WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin AppExperts versions = 1.4.5...

Security Bulletin: NVIDIA GPU Display Drivers - October 2025

NVIDIA has released a software security update for NVIDIA GPU Display Driver to address the issues that are disclosed in this bulletin. To protect your system, download and install this software update through the NVIDIA Driver Downloads page or, for the vGPU software and Cloud Gaming updates,...

PT-2025-41361

Critical vulnerability alert - AWS Client VPN for macOS. Vuln info, including versions and reference links, at SecAlerts: CVE-2021-11462, CVSS 9.3 - https://t.co/8NvHlAebRR ciso cio cto vulnerabilities cybersecurity secalerts msp mssp CVE202511462 awsclient aws https://t.co/RVMw6YoXbF...

SUSE CVE-2025-11458

Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2025-11460

Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. Chromium security severity: High...

WordPress Find Me On plugin <= 2.0.9.1 - Subscriber+ SQL Injection vulnerability

Subscriber+ SQL Injection vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Find Me On versions = 2.0.9.1...

WordPress PopupKit plugin <= 2.1.3 - Unauthenticated SQL Injection via 'id' vulnerability

Unauthenticated SQL Injection via 'id' vulnerability discovered by Rafshanzani Suhada in WordPress Plugin PopupKit versions = 2.1.3...