CVE-2025-40912 CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362...

CWA-2025-006: wasmd's improper error handling may lead to IBC channel opening despite error

CWA-2025-006: Improper error handling may lead to IBC channel opening despite error Severity High Considerable + Likely^1 Affected versions: - wasmd 0.60.0 - wasmd = 0.51.0 0.55.1 Patched versions: - wasmd 0.60.1, 0.55.1, 0.54.1, 0.53.3 Description of the bug A contract erroring during IBC channe...

WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin Ultimate Reviews versions = 3.2.14...

WordPress eForm - WordPress Form Builder < 4.19.1 - Cross Site Scripting (XSS) Vulnerability

WordPress eForm - WordPress Form Builder 4.19.1 - Cross Site Scripting XSS Vulnerability discovered by Dave Jong Patchstack in WordPress Plugin eForm - WordPress Form Builder versions 4.19.1...

CVE-2025-46866 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

BIT-MARIADB-MIN-2023-52970

MariaDB Server 10.4 through 10.5., 10.6 through 10.6., 10.7 through 10.11., 11.0 through 11.0., and 11.1 through 11.4. crashes in Itemdirectviewref::derivedfieldtransformerforwhere...

BIT-MARIADB-MIN-2022-32087

MariaDB v10.2 to v10.7 was discovered to contain a segmentation fault via the component Itemargs::walkargs...

Medium: mariadb1011

Issue Overview: MariaDB Server 10.10 through 10.11. and 11.0 through 11.4. crashes in JOIN::fixallsplittingsinplan. CVE-2023-52971 Affected Packages: mariadb1011 Issue Correction: Run dnf update mariadb1011 --releasever 2023.7.20250609 to update your system. New Packages: aarch64: ...

CVE-2025-49278

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through = 1.0.11...

CVE-2025-48279

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta...

CVE-2025-47651

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through = 2.15.06...

CVE-2025-48279 WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta...

CVE-2025-4652 Broadstreet < 1.51.8 - Reflected XSS

The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-49310

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through = 2.2.8...

CVE-2025-46339

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-30940 WordPress Melipayamak plugin <= 2.2.12 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in melipayamak Melipayamak melipayamak allows Stored XSS.This issue affects Melipayamak: from n/a through = 2.2.12...

PT-2025-24064

Name of the Vulnerable Software and Affected Versions Soar Cloud HRD Human Resource Management System versions prior to 7.3.2025.0408 Description The issue concerns an unrestricted upload of files with dangerous types in the upload file function, allowing remote attackers to execute arbitrary...

Python Library Django 4.2.x < 4.2.22 / 5.1.x < 5.1.10 / 5.2.x < 5.2.2 Log Injection

The detected version of the Django Python package, Django, is 4.2.x prior to 4.2.22, 5.1.x prior to 5.1.10 or 5.2.x prior to 5.2.2. It is, therefore, affected by a log injection vulnerability as disclosed in Django's June 4th, 2025 security advisory. Internal HTTP response logging does not escape...

Autodesk Revit 2023.x < 2023.1.8 / 2024.x < 2024.3.3 / 2025.x < 2025.4.2 / 2026.x < 2026.1 RCE

The version of Autodesk Revit installed on the remote host is prior to 2023.1.8 / 2024.3.3 / 2025.4.2 / 2026.1. It is, therefore, affected by a remote code execution vulnerability. A maliciously crafted RFA file, when linked or imported into Autodesk Revit, can force a Use-After-Free vulnerabilit...

Samba 4.21.x < 4.21.6 / 4.22.x < 4.22.2 Security Bypass Vulnerability

The version of Samba installed on the remote host is 4.21.x prior to 4.21.6, or 4.22.x prior to 4.22.2. It is, therefore, affected by a security bypass vulnerability. A flaw exists with smbd when using Kerberos authentication with smb, due to using the cached user group permissions when...