CVE-2024-56736 Apache HertzBeat: Server-Side Request Forgery (SSRF) in Api Config Oss

Server-Side Request Forgery SSRF vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat incubating: before 1.7.0. Users are recommended to upgrade to version 1.7.0, which fixes the issue...

CVE-2025-22047 x86/microcode/AMD: Fix __apply_microcode_amd()'s return value

In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix applymicrocodeamd's return value When verifysha256digest fails, applymicrocodeamd should propagate the failure by returning false and not -1 which is promoted to true...

CVE-2025-39530

Cross-Site Request Forgery CSRF vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through = 2.1.8...

CVE-2024-52281 Stored Cross-site Scripting vulnerability in Rancher UI

A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field. This issue affects rancher: from 2.9.0 before 2.9.4...

CVE-2025-26153

A Stored XSS vulnerability exists in the message compose feature of Chamilo LMS 1.11.28. Attackers can inject malicious scripts into messages, which execute when victims, such as administrators, reply to the message...

CVE-2024-58249

In wxWidgets before 3.2.7, a crash can be triggered in wxWidgets apps when connections are refused in wxWebRequestCURL...

PT-2025-16644 · WordPress · Bill Minozzi Wp Tools

Name of the Vulnerable Software and Affected Versions: Bill Minozzi WP Tools versions n/a through 5.18 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Path Traversal. This means an attacker could potentially trick a user into performing unintended actions on...

WordPress plugin Listdom 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation...

PT-2025-16637 · Unknown · Rescue Shortcodes

Name of the Vulnerable Software and Affected Versions: Rescue Shortcodes versions n/a through 3.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-16912 · Hitachi Vantara +1 · Hitachi Vantara Pentaho Business Analytics Server +1

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2 Hitachi Vantara Pentaho Business Analytics Server versions 9.3.x Hitachi Vantara Pentaho Business Analytics Server versions 8.3.x Description: The product specifies...

CVE-2025-30735

...

CVE-2025-30722

The CVE-2025-30722 entry concerns Oracle MySQL’s MySQL Client (Client: mysqldump). Affected versions are 8.0.0–8.0.41, 8.4.0–8.4.4 and 9.0.0–9.2.0. The vulnerability is described as difficult to exploit but allows a low-privileged, network-accessing attacker to compromise MySQL Client, potentiall...

CVE-2025-30714

CVE-2025-30714 affects Oracle MySQL Connectors (Connector/Python) for MySQL, specifically the Connector/Python component in MySQL Connectors versions 9.0.0–9.2.0. The vulnerability arises from a flaw in the Connector/Python implementation that could allow a low-privilege, network-located attacker...

CVE-2025-30706

...

CVE-2025-30704

...

CVE-2025-21581

CVE-2025-21581 affects Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. The vulnerability is exploitable over the network with high privileges and can cause a hang or a frequently repeating crash (complete DoS) of MySQL Server. ...

CVE-2025-21574

...

CVE-2025-21573

Oracle Financial Services Revenue Management and Billing (Chatbot component) is affected in versions 5.1.0.0.0, 6.1.0.0.0, and 7.0.0.0.0. The issue is a network-accessible vulnerability in the Chatbot that requires user interaction and could lead to unauthorized data creation/modification, or par...

WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability

Server Side Request Forgery SSRF vulnerability discovered by Marek Mikita in WordPress Plugin WP Optin Wheel versions = 1.4.7...

Dpanel's hard-coded JWT secret leads to remote code execution

Summary The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. Details The Dpanel service, when initiated using its default configuration, includes a hardcoded JWT secret embedded directly...