WordPress Lazy Load for Videos plugin <= 2.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-video-title and href Attributes vulnerability discovered by Webbernaut in WordPress Plugin Lazy Load for Videos versions = 2.18.7...

WordPress All-in-One WP Migration and Backup plugin <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via Import vulnerability discovered by Jack Pas Dark. in WordPress Plugin All-in-One WP Migration versions = 7.97...

WordPress SiteSEO plugin <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Broken Regex Expression vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Broken Regex Expression vulnerability discovered by stealthcopter in WordPress Plugin SiteSEO versions = 1.2.7...

CVE-2025-9478

CVE-2025-9478 : Use-after-free in ANGLE within Google Chrome prior to 139.0.7258.154 can enable a remote attacker to cause heap corruption via a crafted HTML page. Affected component: ANGLE/Chromium WebKit stack used by Chrome. Impact per sources: potential arbitrary code execution, heap corrupti...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues in IBM Semeru Runtime version 17

Summary There are vulnerabilities in IBM Semeru Runtime version 17 used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-50059 DESCRIPTION: Vulnerability in the Oracle Ja...

CVE-2025-52037

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of...

CVE-2025-52036

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...

WordPress Drag and Drop File Upload for Elementor Forms Plugin <= 1.5.3 - Arbitrary File Upload Vulnerability

Arbitrary File Upload Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Drag and Drop File Upload for Elementor Forms versions = 1.5.3...

WordPress Gutenify Plugin <= 1.5.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Gutenify versions = 1.5.4...

Important: Red Hat Security Advisory: aide security update

An update for aide is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

CVE-2025-52036

NotesCMS contains a stored XSS vulnerability (CWE-79) on the /index.php?route=categories page. The issue arises from manipulation of the service descriptions title in the source code, present as of commit 7d821a0f028b0778b245b99ab3d3bff1ac10e2d3 (2024-05-08) and fixed in commit 95322c5121dbd7070f...

CVE-2025-52037

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of...

CVE-2025-52036

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...

CVE-2025-52036

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as o...

WordPress Cars4Rent Theme <= 1.4.2 is vulnerable to PHP Object Injection

Software Cars4Rent Type Theme Vulnerable versions = 1.4.2 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-49434 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 74545c19b3cf Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

tomcat11-11.0.10-1.1 on GA media (moderate)

tomcat11-11.0.10-1.1 on GA media Announcement ID: openSUSE-SU-2025:15491-1 Rating: moderate Cross-References: CVE-2025-48989 CVSS scores: CVE-2025-48989 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2025-48989 SUSE : 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:...

WordPress Event List plugin <= 2.0.4 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by Tonn in WordPress Plugin eventlist versions = 2.0.4...

WordPress Custom Query Shortcode plugin <= 0.4.0 - Authenticated (Contributor+) Path Traversal via lens Parameter vulnerability

Authenticated Contributor+ Path Traversal via lens Parameter vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Custom Query Shortcode versions = 0.4.0...

GHSA-5CMR-4PX5-23PC XGrammar affected by Denial of Service by infinite recursion grammars

Summary This issue: http://github.com/mlc-ai/xgrammar/issues/250 should have it's own security advisory. Since several tools accept and pass user supplied grammars to xgrammar, and it is so easy to trigger it seems like a High...

WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Denver Jackson in WordPress Plugin Taxi Booking Manager for WooCommerce versions = 1.3.0...