CVE-2025-30617

Cross-Site Request Forgery CSRF vulnerability in takien Rewrite rewrite allows Cross Site Request Forgery.This issue affects Rewrite: from n/a through = 0.2.1...

CVE-2025-30619

Cross-Site Request Forgery CSRF vulnerability in SpeakPipe SpeakPipe speakpipe-voicemail-for-websites allows Cross Site Request Forgery.This issue affects SpeakPipe: from n/a through = 0.2...

CVE-2025-30576

Cross-Site Request Forgery CSRF vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through = 2.1.0...

CVE-2025-30523

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Marcel-NL Super Simple Subscriptions super-simple-subscriptions allows SQL Injection.This issue affects Super Simple Subscriptions: from n/a through = 1.1.0...

CVE-2025-30542

CVE-2025-30542 is a CSRF vulnerability in the SoundCloud Ultimate WordPress plugin (SoundCloud Ultimate) affecting versions up to 1.5. The Wordfence vulnerability feed lists this entry with CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), base score 4.3 (Medium). Patch status is Unpatched accordin...

CVE-2025-30538

CVE-2025-30538 describes a CSRF vulnerability in the WordPress plugin Simple Optimizer (affecting up to version 1.2.7). The Initial Document notes a Cross-Site Request Forgery issue with Simple Optimizer and lists affected scope “from n/a through 1.2.7.” The Connected Documents add a Wordfence vu...

CVE-2025-30535

CVE-2025-30535 technical details are not publicly provided in the supplied documents. Monitor for updates from vendors and advisories.

RHSA-2025:3093 Red Hat Security Advisory: kpatch-patch-4_18_0-305_120_1, kpatch-patch-4_18_0-305_138_1, kpatch-patch-4_18_0-305_145_1, and kpatch-patch-4_18_0-305_150_1 security update

Bulletin has no description...

Fedora: Security Advisory (FEDORA-2025-b2bdcfedac)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

GHSA-53GH-P8JC-7RG8 LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

DB-GPT vulnerable to Cross-Site Request Forgery

In version 0.6.0 of eosphoros-ai/db-gpt, the uvicorn app created by dbgptserver uses an overly permissive instance of CORSMiddleware which sets the Access-Control-Allow-Origin to for all requests. This configuration makes all endpoints exposed by the server vulnerable to Cross-Site Request Forger...

CVE-2025-0184 Server-Side Request Forgery (SSRF) in langgenius/dify

A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...

CVE-2025-26853

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema...

PT-2025-12021 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version V12 Strawberry Description: A vulnerability in the start app server function allows for path traversal and OS command injection. The function does not properly sanitize the app name parameter, enabling an attacke...

CVE-2025-25580

CVE-2025-25580 affects yimioa prior to v2024.07.04 and is a SQL injection vulnerability exposed via the listNameBySql() method in the /xml/UserMapper.xml. The entry indicates a local-privilege context with user interaction required and high confidentiality impact, but no exploit details or public...

CVE-2025-27281

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injection.This issue affects All In Menu: from n/a through = 1.1.5...

CVE-2025-26972

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5...

CVE-2025-26978

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through = 6.5.8...

SUSE CVE-2025-2309

A vulnerability has been found in HDF5 1.14.6 and classified as critical. This vulnerability affects the function H5Tbitcopy of the component Type Conversion Logic. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclos...