GHSA-3MF5-R4HG-HFX9 mavo DOM Clobbering vulnerability

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-43169

CVE-2024-43169 affects IBM Engineering Requirements Management DOORS Next versions 7.0.2, 7.0.3, and 7.1. The IBM security bulletin identifies the vulnerability as a Reflected File Download where a user could download a malicious file without verifying code integrity. The IBM CVSS context lists a...

CVE-2024-8261 IDOR in Proliz Software's OBS

Authorization Bypass Through User-Controlled Key vulnerability in Proliz Software OBS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects OBS: before 24.0927...

CVE-2024-47092 Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api

Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api prior to 5.8.1...

MAL-2025-1910 Malicious code in owl.carousel.custom (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1893 Malicious code in meli-tools (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1878 Malicious code in linkedin-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-23881 WordPress LJ Custom Menu Links Plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in littlejon LJ Custom Menu Links lj-custom-menu-links allows Reflected XSS.This issue affects LJ Custom Menu Links: from n/a through = 2.5...

MAL-2025-1816 Malicious code in godaddy-oauth (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1808 Malicious code in explat-client (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1774 Malicious code in com.unity.visualscripting (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1760 Malicious code in cmpuiforoath (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-1869

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "username" parameter in admin/checkavalability.php...

MAL-2025-1697 Malicious code in @smt-front/common (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2025-9431 · Dreamstime · Dreamstime Stock Photos

Name of the Vulnerable Software and Affected Versions: Dreamstime Stock Photos versions n/a through 4.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions n/a...

Oxidized Web RANCID migration page allows unauthenticated user to gain control over Linux user account

In oxidized-web aka Oxidized Web before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web...

CVE-2025-27408

Manifest offers users a one-file micro back end. Prior to version 4.9.2, Manifest employs a weak password hashing implementation that uses SHA3 without a salt. This exposes user passwords to a higher risk of being cracked if an attacker gains access to the database. Without the use of a salt,...

CVE-2024-54175

IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow a local user to cause a denial of service due to an improper check for unusual or exceptional conditions...

CVE-2025-22272

In the "/EPMUI/ModalDlgHandler.ashx?value=showReadonlyDlg" endpoint, it is possible to inject code in the "modalDlgMsgInternal" parameter via POST, which is then executed in the browser. The risk of exploiting vulnerability is reduced due to the required additional bypassing the...

CVE-2025-1319

The Site Mailer – SMTP Replacement, Email API Deliverability & Email Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...