CVE-2025-54026

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in QuanticaLabs GymBase Theme Classes gymbaseclasses allows SQL Injection.This issue affects GymBase Theme Classes: from n/a through = 1.4...

CVE-2025-54018

Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through = 1.8.4...

WordPress plugin CM Pop-Up banners 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-29749 · Creativemindssolutions · Cm Pop-Up Banners

Name of the Vulnerable Software and Affected Versions: CM Pop-Up banners versions n/a through 1.8.4 Description: A missing authorization issue exists in CreativeMindsSolutions CM Pop-Up banners due to incorrectly configured access control security levels. Recommendations: Update CM Pop-Up banners...

Idera Up.Time Monitoring Station 安全漏洞

Idera Up.Time Monitoring Station is a cross-platform server monitoring software from Idera USA. A security vulnerability exists in Idera Up.Time Monitoring Station version 7.2 and earlier, which originates from an arbitrary file upload and could lead to remote code execution...

WordPress gAppointments Plugin <= 1.14.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by 0xd4rk5id3 in WordPress Plugin gAppointments versions = 1.14.1...

gorobbs 路径遍历漏洞

gorobbs is a full-text search engine by letseeqiji's individual developers. A path traversal vulnerability exists in gorobbs 1.0.8 and earlier versions, which stems from a path traversal caused by the parameter filename operation...

CVE-2025-27056

Memory corruption during sub-system restart while processing clean-up to free up resources...

kernel: HID: i2c-hid-of: fix NULL-deref on failed power up

In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which is dereferenced on power-up failures...

HPESBHF04868 rev.1 - HPE Superdome Flex, Flex 280 and Compute Scale-up Server 3200 Platform Servers Using Intel Processor BIOS, INTEL-SA-01247, 2025.2 IPU - Intel Processor Indirect Branch Predictor Advisory, Local Disclosure of Information Vulnerability

Potential Security Impact: Local: Disclosure of Information SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.60.88 HPE Superdome Flex 280 Server - Prior to v2.00.12 HPE Superdome Flex Server - Prior to v4.10.18 CVSS Scores: | CVE | CVS...

BarkBeetle: Stealing Decision Tree Models with Fault Injection

Machine learning models, particularly decision trees DTs, are widely adopted across various domains due to their interpretability and efficiency. However, as ML models become increasingly integrated into privacy-sensitive applications, concerns about their confidentiality have grown, particularly...

HPESBHF04869 rev.1 - HPE Compute Scale-up Server 3200 Platform Servers using Certain Intel Processors, INTEL-SA-01244, 2025.2 IPU, Intel Processor Advisory, Local Denial of Service Vulnerability

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Compute Scale-up Server 3200 - Prior to v1.60.88 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-20054 |...

CVE-2025-27056

CVE-2025-27056 describes a memory corruption issue that occurs during subsystem restart cleanup in a Qualcomm component (kernel-related). The available records indicate a local attacker could trigger memory corruption during the restart/cleanup phase, with potential impact on confidentiality, int...

CVE-2025-27056 Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources...

WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Rau má đậu xanh in WordPress Theme Nuss versions = 1.3.7.1...

CVE-2025-6244

The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...

WordPress Invico - WordPress Consulting Business Theme <= 1.9 - Cross Site Scripting (XSS) Vulnerability

WordPress Invico - WordPress Consulting Business Theme = 1.9 - Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Invico - WordPress Consulting Business Theme versions = 1.9...

WordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download Vulnerability

Arbitrary File Download Vulnerability discovered by 0xd4rk5id3 in WordPress Theme Easy Video Player Wordpress & WooCommerce versions = 10.0...

WordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by LVT-tholv2k in WordPress Plugin WP Pipes versions = 1.4.3...

SUSE CVE-2025-38234

In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in pushrttask Overview ======== When a CPU chooses to call pushrttask and picks a task to push to another CPU's runqueue then it will call findlocklowestrq method which would take a double lock on both CPUs'...