39639 matches found
CVE-2025-69151 WordPress Grand Car Rental theme <= 3.7 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...
CVE-2025-69149
Technical details about CVE-2025-69149 (Top Dog theme LFI) are not publicly provided in the supplied documents. Please monitor official advisories and vendor patches for affected versions.
CVE-2025-69131
Affected software: WordPress & WooCommerce Scraper Plugin, Import Data from Any Site (WordPress). Vulnerability: Unauthenticated Arbitrary File Download in versions
CVE-2025-69121 WordPress Deliciosa theme <= 1.10.0 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Deliciosa = 1.10.0 versions...
CVE-2025-69116 WordPress Iona theme <= 1.0.8 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Iona = 1.0.8 versions...
CVE-2025-69114 WordPress MaxiNet theme <= 1.2.10 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in MaxiNet = 1.2.10 versions...
CVE-2025-69112
Technical details for CVE-2025-69112 (Planty WordPress theme
CVE-2025-69109
Technical details for CVE-2025-69109 are not provided in the supplied documents. No affected versions, root cause, impact, or remediation are stated here. Monitor for updates from the connected sources.
CVE-2025-69104 WordPress Qreatix theme <= 1.9.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Qreatix = 1.9.4 versions...
CVE-2025-58924 WordPress Geya theme <= 1.15 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Geya = 1.15 versions...
CVE-2025-58924
Technical details for CVE-2025-58924 are not provided in the supplied documents. No specifics on affected versions beyond
GHSA-V733-MWR6-FGCM n8n: Same-Origin XSS in Respond to Webhook Node
Impact An authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript ...
n8n: Same-Origin XSS in Respond to Webhook Node
Impact An authenticated user with workflow edit access could configure a Respond to Webhook node to serve binary content with an attacker-controlled Content-Type. The binary response path bypassed the central Content-Security-Policy sandbox header, allowing a public webhook to execute JavaScript ...
NPM: n8n: Same-Origin XSS in Respond to Webhook Node
NPM: n8n: Same-Origin XSS in Respond to Webhook Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.55...
MAL-2026-5911 Malicious code in utils-common-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...
Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2025-66453)
Summary There are vulnerabilities in rhino-1.7.7.2.jar used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-66453. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-66453 DESCRIPTION: Rhino is an open-source implementation of JavaScript written entirely in Jav...
Security Bulletin: MongoDB Enterprised Advanced affected by: Improper Input Validation (CVE-2025-66400)
Summary There are vulnerabilities in mdast-util-to-hast-13.2.0.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-66400. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2025-66400 DESCRIPTION: mdast-util-to-hast is an mdast utility to transform to hast. Fro...
EUVD-2026-37131
Yeoman Environment provides an API to discover, create, and run generators, and to configure where and how a generator is resolved. Versions 2.9.0 through 6.0.0 install missing local generator packages from caller-supplied package names without user confirmation. In downstream consumers that pass...
Server-side Request Forgery (SSRF)
Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the prerenderedErrorPageFetch. An attacker can access sensitive information or interact with...