GHSA-3W94-VQ2X-V5WR ethereum does not check transaction malleability for EIP-2930, EIP-1559 and EIP-7702 transactions

Impact Prior to ethereum crate v0.18.0, signature malleability according to EIP-2 was only checked for "legacy" transactions, but not for EIP-2930, EIP-1559 and EIP-7702 transactions. This is a specification deviation and therefore a high severity advisory if the ethereum crate is used for Ethere...

MITM (Man-in-the-Middle) org.apache.httpcomponents.client5:httpclient5 Dependency in Confluence Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 9.2.4, 9.4.0, and 9.5.1 of Confluence Data Center and Server however LTS version 8.5 is not affected by this CVE. This Third-Party Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

WordPress Education Center Theme <= 3.6.10 is vulnerable to PHP Object Injection

Software Education Center Type Theme Vulnerable versions = 3.6.10 Fixed in 3.6.11 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2024-13786 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 511daf731ac0 Credits Lucio Sá Required privilege...

openSUSE Security Advisory (SUSE-SU-2025:02170-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2025:02164-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via button+modal Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via button+modal Widget vulnerability discovered by Webbernaut in WordPress Plugin WidgetKit versions = 2.5.4...

WordPress Forminator plugin <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion vulnerability

Unauthenticated PHP Object Injection PHAR Triggered via Administrator Form Submission Deletion vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Forminator versions = 1.44.2...

WordPress Amazon Products to WooCommerce plugin <= 1.2.7 - Unauthenticated Server-Side Request Forgery vulnerability

Unauthenticated Server-Side Request Forgery vulnerability discovered by ch4r0n in WordPress Plugin Amazon Products to WooCommerce versions = 1.2.7...

WordPress Magic Buttons for Elementor plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via magic-button Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin Magic Buttons for Elementor versions = 1.0...

WordPress Ads Pro plugin <= 4.89 - Unauthenticated SQL Injection via oid vulnerability

Unauthenticated SQL Injection via oid vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ads Pro versions = 4.89...

WordPress Ads Pro plugin <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate vulnerability

Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Ads Pro versions = 4.89...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id' vulnerability

Unauthenticated Time-Based SQL Injection via 'wpdevartid' vulnerability discovered by shaman0x01 in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.17...

WordPress eventlist plugin <= 1.9.2 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds in WordPress Plugin eventlist versions = 1.9.2...

WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Bonds in WordPress Plugin CouponXxL Custom Post Types versions = 3.0...

WordPress Masteriyo LMS PRO plugin <= 2.20.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Masteriyo LMS PRO versions = 2.20.0...

WordPress Custom Login And Signup Widget plugin <= 1.0 - Arbitrary Code Execution vulnerability

Arbitrary Code Execution vulnerability discovered by Bao Patchstack Alliance in WordPress Plugin Custom Login And Signup Widget versions = 1.0...

WordPress PrivateContent - Mail Actions plugin <= 2.3.2 - Local File Inclusion vulnerability

WordPress PrivateContent - Mail Actions plugin = 2.3.2 - Local File Inclusion vulnerability discovered by Bonds in WordPress Plugin PrivateContent - Mail Actions versions = 2.3.2...

WordPress Case Theme User < 1.0.4 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin Case Theme User versions 1.0.4...

WordPress Leyka plugin <= 3.32 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Leyka versions = 3.32...

WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Martin Herancourt in WordPress Plugin Beautiful Cookie Consent Banner versions = 4.6.1...