CVE-2025-31695 Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS.This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...

CVE-2025-31687

CVE-2025-31687 records an XSS vulnerability in the Drupal SpamSpan filter. Public sources indicate the issue affects SpamSpan filter versions 0.0.0 through 3.2.0 and stems from improper input neutralization during web page generation, enabling cross-site scripting. The vulnerability is fixed in v...

Kibana 8.15.x < 8.17.3 (ESA_2025_06)

The version of Kibana installed on the remote host is prior to 8.17.3. It is, therefore, affected by a vulnerability as referenced in the ESA202506 advisory. - Prototype pollution in Kibana leads to arbitrary code execution via a crafted file upload and specifically crafted HTTP requests. In Kiba...

CVE-2025-23481

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Anzar Ahmed Ni WooCommerce Sales Report Email ni-woocommerce-sales-report-email allows Reflected XSS.This issue affects Ni WooCommerce Sales Report Email: from n/a through = 3.1.4...

CVE-2025-1864

CVE-2025-1864 affects radare2 (radareorg) prior to 5.9.9, due to an improper restriction of operations within the bounds of a memory buffer, enabling a buffer overflow. The issue is documented across multiple advisories/plugins, including openSUSE and Fedora updates that fix CVE-2025-1864 (and re...

CVE-2025-1744

CVE-2025-1744 (radare2) describes an out-of-bounds write vulnerability in radare2 (radareorg) that can cause a heap-based buffer over-read or buffer overflow. Affected version range is radare2 before 5.9.9. The description and references indicate a critical impact (CVSS 3.1/4.0 family) with high ...

WordPress Yoast SEO Plugin < 22.7 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:yoast:yoastseo"; if description...

Azure Linux 3.0 Security Update: redis / valkey (CVE-2024-46981)

The version of redis / valkey installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46981 advisory. - Redis is an open source, in-memory database that persists on disk. An authenticated user May use a...

Apache James vulnerable to denial of service through the use of IMAP literals

Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate...

CVE-2024-1539

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API...

CVE-2024-50248 affecting package kernel for versions less than 6.6.64.2-1

CVE-2024-50248 affecting package kernel for versions less than 6.6.64.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-13302

CVE-2024-13302 affects Drupal Pages Restriction Access module (versions 2.0.0–2.0.2). The vulnerability stemmed from an incorrect authorization mechanism that allows forceful browsing/bypassing access controls. The issue is addressed in version 2.0.3+. Affected product/component: Drupal Pages Res...

CVE-2024-56042 WordPress WPLMS plugin < 1.9.9.5.3 - Unauthenticated SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through 1.9.9.5.3...

PT-2024-36417 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat-Admin versions 2.2.0-beta through 2.2.2-beta Description: The issue is a Cross-Site Scripting XSS vulnerability. It can be exploited via the "/admin/auth/menu" and "/admin/auth/extensions" API endpoints. Recommendations: For versions...

CVE-2023-6856

The WebGL DrawElementsInstanced method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. This issue could allow an attacker to perform remote code execution and sandbox escape. This vulnerability affects Firefox ESR 115.6, Thunderbird 115.6, and Firefox 121...

PT-2023-28285

Name of the Vulnerable Software and Affected Versions Lenosp versions 1.0.0 through 1.2.0 Description The issue concerns SQL Injection via the log query module. Recommendations For versions 1.0.0 through 1.2.0, consider restricting access to the log query module to minimize the risk of...

PT-2023-27034

Name of the Vulnerable Software and Affected Versions AOMedia versions 3.0.0 through 3.5.0 Description The issue is related to an invalid read memory access via the component assign frame buffer p in av1/common/av1 common int.h. This component is part of the AOMedia library. Recommendations For...

CVE-2022-41766

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyrolled message can leak a user name when the user has been revision deleted/suppressed...

AZL-25858 CVE-2023-27537 affecting package rust for versions less than 1.72.0-2

A double free vulnerability exists in libcurl 8.0.0 when sharing HSTS data between separate "handles". This sharing was introduced without considerations for do this sharing across separate threads but there was no indication of this fact in the documentation. Due to missing mutexes or thread...

CVE-2023-0070 ResponsiveVoice Text To Speech < 1.7.7 - Contributor+ Stored XSS

The ResponsiveVoice Text To Speech WordPress plugin before 1.7.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scriptin...