12580 matches found
PT-2025-26408 · Radiustheme · Radiustheme Classified Listing
Name of the Vulnerable Software and Affected Versions: RadiusTheme Classified Listing versions n/a through 4.2.0 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' vulnerability. This allows...
PT-2025-26382 · Codepeople · Cp-Polls
Name of the Vulnerable Software and Affected Versions: codepeople CP Polls versions 1.0.0 through 1.0.81 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...
PT-2025-26369 · Unknown · Fridaysystems Inventory Presser
Name of the Vulnerable Software and Affected Versions: fridaysystems Inventory Presser versions through 15.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...
PT-2025-26391 · Unknown · Anant Addons For Elementor
Name of the Vulnerable Software and Affected Versions: Anant Addons for Elementor versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: F...
PT-2025-26324 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.11.x through 9.11.15 Mattermost versions 10.5.x through 10.5.5 Mattermost versions 10.6.x through 10.6.5 Mattermost versions 10.7.x through 10.7.2 Mattermost versions 10.8.x through 10.8.0 Description: The issue is relat...
PT-2025-26392 · Unknown · Gutenberg Blocks – Acf Blocks Suite
Name of the Vulnerable Software and Affected Versions: Gutenberg Blocks – ACF Blocks Suite versions through 2.6.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...
PT-2025-26364 · Woocommerce · Wetail Woocommerce Fortnox Integration
Name of the Vulnerable Software and Affected Versions: Wetail WooCommerce Fortnox Integration versions through 4.5.5 Description: The issue is related to a Missing Authorization vulnerability, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For...
WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.8 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Post and Page Builder by BoldGrid versions = 1.27.8...
Security Bulletin: IBM Edge Data Collector is vulnerable to axios-1.7.7.tgz, axios-1.7.9.tgz CVE-2025-27152
Summary IBM Edge Data Collector is vulnerable to axios-1.7.7.tgz, axios-1.7.9.tgz CVE-2025-27152. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-27152 DESCRIPTION: axios is a promise based HTTP client for the browser and node.js. Th...
PT-2025-26209 · WordPress · Football-Pool
Name of the Vulnerable Software and Affected Versions: Football Pool plugin for WordPress versions up to, and including, 2.12.4 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows authenticated...
PT-2025-26219 · Hydra · Hydra
Name of the Vulnerable Software and Affected Versions: Hydra versions prior to 0.22.0 Description: Hydra is a layer-two scalability solution for Cardano. The issue arises from the assumption of L1 event finality, where the system does not consider failed transactions on the Cardano L1. This makes...
PT-2025-26241 · Ubiquiti · Unifi Network Application
Name of the Vulnerable Software and Affected Versions: UniFi Network versions 9.1.120 and earlier Description: A misconfigured query in UniFi Network could allow users to authenticate to Enterprise WiFi or VPN Server l2tp and OpenVPN using a device’s MAC address from 802.1X or MAC Authentication,...
PT-2025-26208 · WordPress · Oceanwp
Name of the Vulnerable Software and Affected Versions: OceanWP theme for WordPress versions up to, and including, 4.0.9 Description: The issue is related to Stored Cross-Site Scripting via the Select HTML tag due to insufficient input sanitization and output escaping. This allows authenticated...
CVE-2025-23168
The Versa Director SD-WAN orchestration platform implements Two-Factor Authentication 2FA using One-Time Passcodes OTP delivered via email or SMS. Versa Director accepts untrusted user input when dispatching 2FA codes, allowing an attacker who knows a valid username and password to redirect the O...
CVE-2022-50184 drm/meson: encoder_hdmi: Fix refcount leak in meson_encoder_hdmi_init
In the Linux kernel, the following vulnerability has been resolved: drm/meson: encoderhdmi: Fix refcount leak in mesonencoderhdmiinit ofgraphgetremotenode returns remote device nodepointer with refcount incremented, we should use ofnodeput on it when done. Add missing ofnodeput to avoid refcount...
CVE-2022-50012 powerpc/64: Init jump labels before parse_early_param()
In the Linux kernel, the following vulnerability has been resolved: powerpc/64: Init jump labels before parseearlyparam On 64-bit, calling jumplabelinit in setupfeaturekeys is too late because static keys may be used in subroutines of parseearlyparam which is again subroutine of earlyinitdevtree...
RHSA-2025:9206 Red Hat Security Advisory: grafana-pcp security update
Bulletin has no description...
RHSA-2025:9205 Red Hat Security Advisory: git-lfs security update
Bulletin has no description...