EUVD-2025-84349

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature...

CVE-2025-7430 Stored XSS

Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Folder Message Count and Size report...

EUVD-2025-74034

Zohocorp ManageEngine Exchange Reporter Plus versions 5723 and below are vulnerable to the Stored XSS Vulnerability in the Mails Deleted or Moved report...

WordPress CTL Arcade Lite plugin <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation vulnerability

Cross-Site Request Forgery to Plugin Activation and Deactivation vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin CTL Arcade Lite versions = 1.0...

PT-2025-46359

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 145 Firefox ESR versions prior to 140.5 Description A same-origin policy bypass exists in the DOM: Workers component. This allows for potential unauthorized access or manipulation of data due to insufficient...

CVE-2025-62813 affecting package lz4 for versions less than 1.9.4-2

CVE-2025-62813 affecting package lz4 for versions less than 1.9.4-2. A patched version of the package is available...

CVE-2025-11021 affecting package libsoup for versions less than 3.0.4-10

CVE-2025-11021 affecting package libsoup for versions less than 3.0.4-10. A patched version of the package is available...

CVE-2025-4373 affecting package glib for versions less than 2.71.0-7

CVE-2025-4373 affecting package glib for versions less than 2.71.0-7. A patched version of the package is available...

AZL-69961 CVE-2025-64434 affecting package kubevirt for versions less than 0.59.0-33

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler via verifyPeerCert, an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileg...

WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Traveler versions 3.2.6...

CVE-2025-59530 affecting package coredns for versions less than 1.11.4-11

CVE-2025-59530 affecting package coredns for versions less than 1.11.4-11. A patched version of the package is available...

CVE-2025-40778 affecting package bind for versions less than 9.20.15-1

CVE-2025-40778 affecting package bind for versions less than 9.20.15-1. A patched version of the package is available...

CVE-2025-62053

CVE-2025-62053 describes a Local File Inclusion (LFI) vulnerability in the WordPress Houzez theme prior to version 4.2.0 . The issue arises from an improper control of the filename used in include/require statements within the PHP code, enabling an attacker to potentially include local files on t...

CVE-2025-59556 WordPress GoStore theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup GoStore gostore allows Reflected XSS.This issue affects GoStore: from n/a through 1.6.4...

CVE-2025-58964 WordPress Enzy theme < 1.6.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through 1.6.4...

CVE-2025-12638 affecting package keras for versions less than 3.3.3-5

CVE-2025-12638 affecting package keras for versions less than 3.3.3-5. A patched version of the package is available...

PT-2025-45246

Missing Authorization vulnerability in kamleshyadav Miraculous miraculous allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Miraculous: from n/a through 2.0.9...

WordPress LinkedIn Resume plugin <= 2.00 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin LinkedIn Resume versions = 2.00...

AZL-69631 CVE-2025-12464 affecting package qemu for versions less than 8.2.0-25

A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This...

AZL-69470 CVE-2025-62229 affecting package xorg-x11-server-Xwayland for versions less than 24.1.6-3

A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an...