CVE-2025-5926

The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorrect nonce validation on the linkshieldmenuoptions function. This makes it possible for unauthenticated attackers to update settings and...

CVE-2025-5928

The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the wpslidingpaneluseroptions function. This makes it possible for unauthenticated attackers t...

CVE-2025-6063

The CVE CVE-2025-6063 affects the XiSearch bar WordPress plugin (versions up to and including 2.6). The root cause is missing/incorrect nonce validation on the xisearch-key-config page, enabling Cross-Site Request Forgery. This allows unauthenticated attackers to update plugin settings and inject...

CVE-2025-6062 Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update

The Yougler Blogger Profile Page plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, v1.01. This is due to missing or incorrect nonce validation on the 'yougler-plugin.php' page. This makes it possible for unauthenticated attackers to update the...

BIT-GITLAB-2025-5996 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

CVE-2025-6059

The Seraphinite Accelerator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.27.21. This is due to missing or incorrect nonce validation on the 'OnAdminApiCacheOpBegin' function. This makes it possible for unauthenticated attackers to perfor...

PT-2025-25456 · WordPress · Seraphinite Accelerator

Name of the Vulnerable Software and Affected Versions: Seraphinite Accelerator plugin for WordPress versions up to, and including, 2.27.21 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the OnAdminApi CacheOpBegin function. This...

CVE-2025-5938

The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the importtemplates function. This makes it possible for...

CVE-2025-5938

CVE-2025-5938 relates to the WordPress plugin “Digital Marketing and Agency Templates Addons for Elementor.” The issue is a Cross-Site Request Forgery caused by missing or incorrect nonce validation in the import_templates() function, affecting all versions up to and including 1.1.1. This enables...

PT-2025-25376 · WordPress · Link Shield

Name of the Vulnerable Software and Affected Versions: The Link Shield plugin for WordPress versions up to, and including, 0.5.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the link shield menu options function. This allows...

Microsoft Office Code Execution Vulnerability (CNVD-2025-13270)

Microsoft Office is an office software suite of products from the U.S. company Microsoft Microsoft. The product's common components include Word, Excel, Access, Powerpoint, FrontPage, etc.. A code execution vulnerability exists in Microsoft Office, which is caused due to improper input validation...

PT-2025-25378 · WordPress · Wp2Html

Name of the Vulnerable Software and Affected Versions: WP2HTML plugin for WordPress versions prior to 1.0.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the save function. This allows unauthenticated attackers to update plugin...

CVE-2025-47968

Improper input validation in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...

CVE-2024-54019

A improper validation of certificate with host mismatch in Fortinet FortiClientWindows version 7.4.0, versions 7.2.0 through 7.2.6, and 7.0 all versions allow an unauthorized attacker to redirect VPN connections via DNS spoofing or another form of redirection...

SUSE-SU-2025:01748-2 Security update for postgresql15

This update for postgresql15 fixes the following issues: Upgrade to 15.13: - CVE-2025-4207: Fixed PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation bsc1242931 Changelog: https://www.postgresql.org/docs/release/15.13/...

CVE-2025-5996

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

CVE-2025-1516

An issue has been discovered in GitLab CE/EE affecting all versions from 8.7 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Improper input validation in Tokens Names could be used to trigger a denial of service...

CVE-2025-1478

CVE-2025-1478 affects GitLab CE/EE. The issue is a lack of input validation in Board Names, which can be exploited to trigger a denial of service. Affected versions are: 8.13–17.10.6, 17.11–17.11.2, and 18.0–18.0.0. Remediation (fixed in): GitLab 17.10.7+, 17.11.3+, and 18.0.1+. No exploitation d...

CVE-2025-5996 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 2.1.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. A lack of input validation in HTTP responses could allow an authenticated user to cause denial of service...

CVE-2025-5996

CVE-2025-5996 describes a denial-of-service issue in GitLab CE/EE across multiple versions (2.1.0–17.10.7, 17.11.0–17.11.3, 18.0.0–18.0.1) caused by insufficient input validation in HTTP responses. An authenticated user can trigger DoS, with CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base sco...