CVE-2025-47691

Improper Control of Generation of Code 'Code Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Code Injection.This issue affects Ultimate Member: from n/a through = 2.10.3...

PT-2025-20483 · Unknown · Envolve Plugin

Name of the Vulnerable Software and Affected Versions: Envolve Plugin versions up to, and including, 1.0 Description: The issue is related to arbitrary file uploads due to missing file type validation in the zetra languageUpload and zetra fontsUpload functions. This allows unauthenticated attacke...

PT-2025-20379

Name of the Vulnerable Software and Affected Versions SeriaWei ZKEACMS versions prior to 4.3 Description A security flaw has been discovered in the CheckPage/Suggestions function within the SEOSuggestions component of SeriaWei ZKEACMS. Manipulation of this function, located in the...

CVE-2025-35939 Craft CMS stores user-provided content in session files

Craft CMS stores arbitrary content provided by unauthenticated users in session files. This content could be accessed and executed, possibly using an independent vulnerability. Craft CMS redirects requests that require authentication to the login page and generates a session file on the server at...

CVE-2025-47590

Cross-Site Request Forgery CSRF vulnerability in JExtensions Store WPSpeed wpspeed allows Cross Site Request Forgery.This issue affects WPSpeed: from n/a through = 2.6.5...

CVE-2025-47490

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through = 1.3.4...

CVE-2025-47493

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ultimate Blocks Ultimate Blocks ultimate-blocks allows DOM-Based XSS.This issue affects Ultimate Blocks: from n/a through = 3.2.9...

CVE-2025-47446

Cross-Site Request Forgery CSRF vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through = 2.3.6...

SUSE-SU-2025:1456-1 Security update for sqlite3

This update for sqlite3 fixes the following issues: - CVE-2025-29087,CVE-2025-3277: Fixed integer overflow in sqlite concat function bsc1241020 - CVE-2025-29088: Fixed integer overflow through the SQLITEDBCONFIGLOOKASIDE component bsc1241078 Other fixes: - Updated to version 3.49.1 from Factory...

CVE-2025-47547 WordPress SendPulse Email Marketing Newsletter <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SendPulse SendPulse Email Marketing Newsletter allows Stored XSS. This issue affects SendPulse Email Marketing Newsletter: from n/a through 2.1.6...

CVE-2025-47546

CVE-2025-47546: CSRF in WordPress WP Compress

CGA-V43X-7RRM-XQ74

Bulletin has no description...

PT-2025-20136 · Unknown · Eli'S Related Posts Footer Links/Widget

Name of the Vulnerable Software and Affected Versions: ELI's Related Posts Footer Links and Widget versions 1.2.04.20 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended...

GHSA-8GQJ-226H-GM8R Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling

Overview This vulnerability allows an attacker to impersonate any user during SAML authentication by tampering with a valid SAML response. This can be done by adding attributes to the response. Am I Affected? You are affected by this SAML Attribute Smuggling vulnerability if you are using...

WordPress PeproDev Ultimate Profile Solutions plugin 1.9.1-7.5.2 - Missing Authorization to Unauthenticated Email Enumeration

Missing Authorization to Unauthenticated Email Enumeration vulnerability discovered by kr0d in WordPress Plugin PeproDev Ultimate Profile Solutions versions 1.9.1-7.5.2...

CVE-2025-0984

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection. This issue...

CGA-W77M-GMG8-89WW

Bulletin has no description...

nodejs:22 security update

nodejs 1:22.15.0-1 - Update to 22.15.0 - Drop upstream patches 1:22.13.1-4 - Patch fix for sqlite CVE-2025-31498 Resolves: RHEL-87300 1:22.13.1-3 - Update c-ares to newest version with fix for CVE-2025-31498 Resolves: RHEL-86581...

PT-2025-18688 · Gotenna · Gotenna Mesh

Name of the Vulnerable Software and Affected Versions: goTenna Mesh versions 5.5.3 with firmware 1.1.12 Description: A problem was discovered in goTenna Mesh devices where the verification token used for sending SMS through a goTenna server is hardcoded in the application. This issue affects...

CVE-2024-9876

CVE-2024-9876 describes a MAID (Modification of Assumed-Immutable Data) vulnerability affecting ABB ANC, ANC-L and ANC-mini up to version 1.1.4. The issue occurs in multiple ABB products (ANC through ANC-mini) with affected versions listed as 1.1.4 and earlier. Reported CVSS metrics indicate a hi...