CVE-2025-52484

The CVE concerns risc0-zkvm prior to version 2.1.0. A missing constraint in the rv32im circuit allows a malicious prover to exploit any 3-register RISC-V instruction (e.g., remu, divu) by making rs1 appear equal to rs2, potentially compromising zkVM computations. Affected releases: risc0-zkvm 2.0...

MediaWiki >= 3.3.0 < 3.3.1 XSS Vulnerability

MediaWiki is prone to a cross-site scripting XSS vulnerability. Note: This VT has been deprecated as it had targeted the wrong product. It is therefore no longer functional. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

MediaWiki >= 2.31.0 < 3.3.1 XSS Vulnerability

MediaWiki is prone to a cross-site scripting XSS vulnerability. Note: This VT has been deprecated as it had targeted the wrong product. It is therefore no longer functional. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

PT-2025-26361 · Unknown · Dfactory Download Attachments

Name of the Vulnerable Software and Affected Versions: dFactory Download Attachments versions n/a through 1.3.1 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows exploiting incorrectly configured access control security levels. Th...

PT-2025-26402 · WordPress · Wp-Members

Name of the Vulnerable Software and Affected Versions: WP-Members versions through 3.5.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2025-26385 · Unknown · Spark Multipurpose

Name of the Vulnerable Software and Affected Versions: Spark Multipurpose versions 1.0.0 through 1.0.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker can...

PT-2025-26342 · WordPress · Upstream

Name of the Vulnerable Software and Affected Versions: UpStream: a Project Management Plugin for WordPress versions prior to 2.1.0 Description: The issue affects the access control security levels in the UpStream plugin, allowing exploitation due to incorrectly configured security levels...

PT-2025-26331 · Unknown · Nasatheme Elessi

Name of the Vulnerable Software and Affected Versions: NasaTheme Elessi versions n/a through 6.3.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For versions n/a...

Fedora: Security Advisory (FEDORA-2025-ad58eb378b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DLA-4222-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-26359 · WordPress · Wp-Recall

Name of the Vulnerable Software and Affected Versions: WP-Recall versions prior to 16.26.14 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions prior to 16.26.14, update to...

PT-2025-26346 · Eyecix · Eyecix Jobsearch

Name of the Vulnerable Software and Affected Versions: eyecix JobSearch versions n/a through 2.9.0 Description: The issue affects eyecix JobSearch, allowing exploitation of incorrectly configured access control security levels through an Authorization Bypass Through User-Controlled Key...

PT-2025-26335 · Unknown · Live Sports Streamthunder

Name of the Vulnerable Software and Affected Versions: Live Sports Streamthunder versions n/a through 2.1 Description: A Cross-Site Request Forgery CSRF issue allows unauthorized actions to be performed on behalf of a user. This issue affects the Live Sports Streamthunder software. Recommendation...

Security Bulletin: IBM QRadar SIEM contains multiple vulnerabilities.

Summary IBM Security QRadar SIEM is affected by multiple vulnerabilities that could allow unauthorized access to sensitive data or arbitrary command execution. These issues have been addressed in the latest update. Vulnerability Details CVEID:CVE-2025-36050 DESCRIPTION: IBM QRadar stores...

DotVVM allows path traversal when deployed in Debug mode

Description There is a path traversal vulnerability in any DotVVM application started in Debug mode, if at least one resource with the FileResourceLocation has been added. The vulnerability allows an attacker to read arbitrary files from the filesystem accessible by the web application i.e...

Wireshark Security Update (wnpa-sec-2023-22) - Mac OS X

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

Ubuntu: Security Advisory (USN-7576-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu: Security Advisory (USN-7573-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-26142

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0-rc2 Description A use-after-free issue in the Linux kernel's md-raid module can be triggered when the md bitmap destroy function is called before the thread is destroyed, potentially causing a kernel panic...

Debian: Security Advisory (DLA-4220-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...