BELL-CVE-2025-1365

Bulletin has no description...

CVE-2024-13522 magayo Lottery Results <= 2.0.12 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

CVE-2024-57971

DataSourceResource.java in the SpagoBI API support in Knowage Server in KNOWAGE before 8.1.30 does not ensure that java:comp/env/jdbc/ occurs at the beginning of a JNDI Name...

PT-2025-7202 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.1115 Description: The issue arises when redirecting the output of the :display command to a register that is being displayed, leading to a use-after-free. This occurs because Vim frees the register content before...

CVE-2025-25468

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c...

CVE-2025-22921

FFmpeg git-master,N-113007-g8d24a28d06 was discovered to contain a segmentation violation via the component /libavcodec/jpeg2000dec.c...

CVE-2025-25473

FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformatfreecontext function in libavutil/mem.c...

CVE-2025-25469

FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c...

CVE-2025-25471

FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c...

PT-2025-6821 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM versions 5.13.0 and prior Description: A time-based blind SQL Injection vulnerability exists in the EditEventTypes functionality, allowing an attacker to execute arbitrary SQL queries. The newCountName parameter is directly...

BIT-GITLAB-2025-1198 Insufficient Session Expiration in GitLab

An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results...

Denial Of Service (DoS)

parse-duration is vulnerable to Denial Of Service DoS. The vulnerability is due to CPU-bound operations that resolve a provided string, causing delays of 0.5ms to 50ms per operation and crashes due to memory exhaustion when the string size reaches approximately 10 MB with Unicode characters, allo...

CVE-2025-1378

A flaw was found in radare2 rasm2. This vulnerability allows memory corruption via local access and manipulation of the /libr/main/rasm2.c library...

MAL-2025-1422 Malicious code in kcex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 250e2784873b2d4ccedb1c0017d13580afe0f3a3c3d956afeedcc1b962cc197d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0995

Use after free in V8 in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High Mitigation Mitigation for this issue is either not available or the currently available options do not meet the R...

OSV-2025-133 Stack-buffer-overflow in se_read_conf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=396958482 Crash type: Stack-buffer-overflow READ 1 Crash state: sereadconf runconfighandler snmpconfigwhen...

CVE-2025-23647

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ariagle WP-Clap wp-clap allows Reflected XSS.This issue affects WP-Clap: from n/a through = 1.5...

CVE-2025-23571

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in makong Internal Links Generator internal-links-generator allows Reflected XSS.This issue affects Internal Links Generator: from n/a through = 3.51...

CVE-2025-23742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Podamibe Nepal Podamibe Twilio Private Call podamibe-twilio-private-call allows Reflected XSS.This issue affects Podamibe Twilio Private Call: from n/a through = 1.0.1...

CVE-2025-24615

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in fatcatapps Analytics Cat analytics-cat allows Reflected XSS.This issue affects Analytics Cat: from n/a through = 1.1.2...