821 matches found
CVE-2025-2857 Incorrect handle could lead to sandbox escapes
Following the recent Chrome sandbox escape CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was...
CVE-2025-2242
An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...
CVE-2025-2242 Incorrect Authorization in GitLab
An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin before but has since been downgraded to a regular user to continue to maintain elevated privileges to...
CVE-2025-26560 WordPress WP Contact Form III Plugin <= 1.6.2d - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound WP Contact Form III allows Reflected XSS. This issue affects WP Contact Form III: from n/a through 1.6.2d...
BIT-HUBBLE-RELAY-2025-30162 East-west traffic not subject to egress policy enforcement for requests via Gateway API load balancers
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to...
CVE-2025-30534
Cross-Site Request Forgery CSRF vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through = 1.2...
CVE-2025-30540
CVE-2025-30540 affects AvaiBook vacation rental booking engine (AvaiBook <= 1.2). It is described as a Stored XSS (Improper Neutralization of Input During Web Page Generation) in AvaiBook. The connected Wordfence report lists AvaiBook
CVE-2025-25035
Improper Neutralization of Input During Web Page Generation Cross-site Scripting vulnerability in Jalios JPlatform 10 allows for Reflected XSS and Stored XSS.This issue affects JPlatform 10: before 10.0.8 SP8, before 10.0.7 SP7, before 10.0.6 SP6 and Jalios Workplace 6.2, Jalios Workplace 6.1,...
CVE-2025-25035
The CVE-2025-25035 issue affects Jalios JPlatform 10 (before 10.0.8 SP8, before 10.0.7 SP7, before 10.0.6 SP6) and Jalios Workplace 5.3–5.5 up to 6.2/6.1/6.0, with both Reflected and Stored XSS reported. Root cause: Improper Neutralization of Input During Web Page Generation, leading to cross-sit...
Juniper Junos OS Local Arbitrary Code Execution (JSA93446)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA93446 advisory: - An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the...
CVE-2025-26976 WordPress PrivateContent plugin <= 8.11.4 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through = 8.11.4...
GitLab 12.3 < 17.7.7 / 17.8 < 17.8.5 / 17.9 < 17.9.2 (CVE-2025-1257)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in GitLab EE affecting all versions starting with 12.3 before 17.7.7, 17.8 prior to 17.8.5, and 17.9 prior to 17.9.2. A vulnerability in certain GitLab instances could allow an...
Joomla! RCE Vulnerability (20250301)
Joomla! is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...
CVE-2025-28941
Cross-Site Request Forgery CSRF vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a through = 2.2.4...
CVE-2025-26707
CVE-2025-26707 concerns ZTE GoldenDB. Multiple sources confirm an Improper Privilege Management vulnerability enabling privilege escalation. Affected product: ZTE GoldenDB, specifically versions 6.1.03 through 6.1.03.05. Root cause is improper privilege management that can allow an unauthorized a...
JVN#24992507: Multiple vulnerabilities in RemoteView Agent (for Windows)
RemoteView allows a local PC to connect and control remote PCs through the cloud service provided by RSUPPORT Co.,Ltd. On the remote PCs should be installed RemoteView Agent. The following vulnerabilities are reported on RemoteView Agent installation. Incorrect access permission of a specific...
CVE-2025-26928
Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through = 3.0.2...
CVE-2025-26905
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through = 4.3.1...
CVE-2025-26752
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in videowhisper Broadcast Live Video videowhisper-live-streaming-integration allows Path Traversal.This issue affects Broadcast Live Video: from n/a through = 6.2...
CVE-2024-31862
Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue...