update-apt-package

Playbook de actualización del paquete APT debido a CVE-2019-3462...

CVE-2025-61228

CVE-2025-61228 Alerta Este problema parece ser peor de lo que el desarrollador sugiere, así que no quiero que esta parte se pierda en la maleza. El desarrollador señaló en su blog: Esto solo puede suceder si un programa que se ejecuta en su sistema está buscando a SuperDuper para realizar una...

CLSA-2026-1790759630 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 7.3.3-tuxcare.1...

CLSA-2026-1790759588 TuxCare security update for fast-uri (1 CVE)

TuxCare rebuilt fast-uri to address 1 CVE. Fixed in 2.4.0-tuxcare.3...

CLSA-2026-1790758113 TuxCare security update for vite (2 CVEs)

TuxCare rebuilt vite to address 2 CVEs. Fixed in 8.0.9-tuxcare.1...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.49 bug fix and security update

Red Hat OpenShift Container Platform release 4.19.49 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...

CLSA-2026-1790754735 TuxCare security update for pillow (8 CVEs)

TuxCare rebuilt pillow to address 8 CVEs. Fixed in 8.4.0.post8+tuxcare...

CVE-2025-14221

Descripción 1. CVE-2025-14221 2. Descubridor: Fatma Trabelsi 3. Proveedor del producto: SourceCodester 4. Producto afectado: Online Banking System 1.0 POC Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en la funcionalidad de actualización del perfil de usuario de la aplicación. ...

ROOT-APP-NPM-CVE-2026-47137 CVE-2026-47137 in vm2 - Patched by Root

Root has patched CVE-2026-47137 in the vm2 package for Root:npm. Multiple fixed versions available...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85576 All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update

The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them...

CVE-2026-85576

The All in One Files Upload WordPress plugin, specifically versions before 2.0.17 , is vulnerable to an unauthorized settings modification. The root cause is a lack of capability checks and a failure to verify the authenticity of the request when saving plugin settings. This flaw allows any authe...

WordPress All in One Files Upload plugin < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin All in One Files Upload versions 2.0.17...

CLSA-2026-1790747802 TuxCare security update for django (2 CVEs)

TuxCare rebuilt django to address 2 CVEs. Fixed in 4.0.post22+tuxcare...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. id: CVE-2012-4242 info: name: WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting author:...

74cms - ajax_officebuilding.php SQL Injection

A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajaxofficebuilding.php. id: CVE-2020-22210 info: name: 74cms - ajaxofficebuilding.php SQL Injection author: ritikchaddha severity: critical description: | A SQL injection vulnerability exists in 74cms 3.2.0 via the x...

Microweber Information Disclosure

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...

UpdraftPlus < 1.22.9 - Cross-Site Scripting

The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

Tutor LMS <= 2.1.10 - SQL Injection

Tutor LMS – eLearning and online course solution plugin for WordPress all versions up to 2.6.1 contains a time-based SQL Injection caused by insufficient escaping on the questionid parameter in SQL queries, letting authenticated attackers with subscriber or higher access extract sensitive...