CVE-2024-55581

Removed by vendor...

CVE-2024-50691

SunGrow iSolarCloud Android app (V2.1.6.20241104 and earlier) is affected by missing SSL certificate validation, allowing MITM impersonation of the iSolarCloud server. The vulnerability enables an attacker to intercept or modify communications between the Android app and the server. CVSSv3.1 base...

PT-2025-8684 · WordPress · The Essential Blocks – Page Builder Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress versions up to, and including, 5.2.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and...

PT-2025-7812 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.9 Description: The issue concerns the Photo Gallery, Sliders, Proofing and WordPress plugin, where some of its image settings are not properly sanitized and...

Azure Linux 3.0 Security Update: cloud-hypervisor-cvm / openssl (CVE-2024-12797)

The version of cloud-hypervisor-cvm / openssl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12797 advisory. - Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server M...

SUSE SLES12 Security Update : openssh (SUSE-SU-2025:0659-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:0659-1 advisory. - CVE-2025-26465: Fixed a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040. - Add a s390 specific ioctl for ECC hardware suppor...

CVE-2025-26756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through = 3.5.0...

Man-in-the-middle(MitM) Attack

homeassistant is vulnerable to Man-in-the-middleMitM Attack. The vulnerability is due to missing SSL certificate verification and improper migration of the verifyssl parameter to the ssl parameter in aiohttp, which unintentionally disabled SSL verification, allows an attacker to intercept and...

PT-2025-7704 · WordPress · The Photo Contest | Competition | Video Contest

Name of the Vulnerable Software and Affected Versions: The Photo Contest | Competition | Video Contest WordPress plugin versions 2.8.1 and earlier Description: The issue is related to a Reflected Cross-Site Scripting that could be used against high privilege users such as admin. This occurs becau...

Synology DiskStation Manager (DSM) Multiple Vulnerabilities (Synology-SA-25:01, Synology-SA-25:03) - Unreliable Remote Version Check

Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CentOS 9 : openssh-8.7p1-45.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the openssh-8.7p1-45.el9 build changelog. - A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious...

Synology DiskStation Manager (DSM) Multiple Vulnerabilities (Synology-SA-25:01, Synology-SA-25:03) - Remote Known Vulnerable Versions Check

Synology DiskStation Manager DSM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Security update for openssh

This update for openssh fixes the following issues: CVE-2025-26465: Fixed a MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client bsc1237040. Add a s390 specific ioctl for ECC hardware support bsc1225637: for migration to openssh 8.4: write active/enabled switch over files only if not yet...

Exploit for Protection Mechanism Failure in 7-Zip

7-Zip-CVE-2025-0411-POC CVE-2025-0411 Details "This vuln...

CVE-2025-1001

Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to alter network traffic and carry out a machine-in-the-middle attack MITM. An attacker could modify the server's response and deliver a...

CVE-2025-26756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through = 3.5.0...

CVE-2025-26756

CVE-2025-26756 : Stored XSS in the WordPress plugin “Magic the Gathering Card Tooltips” (grimdonkey)

CVE-2025-26756 WordPress Magic the Gathering Card Tooltips plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through = 3.5.0...

CVE-2025-26756 WordPress Magic the Gathering Card Tooltips plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grimdonkey Magic the Gathering Card Tooltips magic-the-gathering-card-tooltips allows Stored XSS.This issue affects Magic the Gathering Card Tooltips: from n/a through = 3.5.0...

CVE-2025-1509

The The Show Me The Cookies plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...