ALSA-2025:4362 Moderate: ghostscript security update

The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: heap buffer over write vulnerability in GhostScript's lp8000printpage in...

CVE-2025-3965

A vulnerability has been found in itwanger paicoding 1.0.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /article/app/post. The manipulation of the argument content leads to cross site scripting. The attack can be launched remotely. The...

Important: kernel

Issue Overview: A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. In this flaw an attacker with local user access may lead to a system crash or a leak of internal kernel information. CVE-2023-3567 In the Linux kernel, the following...

WordPress Gutenverse plugin <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via countdown Block vulnerability discovered by Webbernaut in WordPress Plugin Gutenverse versions = 2.2.1...

CVE-2025-46672

Summary : CVE-2025-46672 affects NASA CryptoLib up to v1.3.1 (before 1.3.2). The root cause is that the OTAR crypto function return status is not checked, which could allow incorrect handling of OTAR results and potentially enable spacecraft hijacking. Impact : the issue is described as a securit...

CVE-2025-46689

CVE-2025-46689 affects Ververica Platform 2.14.0 with a Reflected XSS vulnerability exposed via the URI path namespaces/default/formats . The issue involves user-controlled input in that path, allowing an attacker to trigger script execution in a victim’s browser when the vulnerable page is loade...

CVE-2025-39382

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in danielpataki ACF: Google Font Selector acf-google-font-selector-field allows Reflected XSS.This issue affects ACF: Google Font Selector: from n/a through = 3.0.1...

CVE-2025-26413

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the offset input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. User...

CVE-2025-3760

A stored cross-site scripting XSS vulnerability exists with radio button type custom fields in Liferay Portal 7.2.0 through 7.4.3.129, and Liferay DXP 2024.Q4.1 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.9, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10...

CVE-2025-46247

Missing Authorization vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Appointment Booking Calendar: from n/a through = 1.3.92...

CVE-2025-39456

Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through = 2.2...

CVE-2025-22774

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through = 1.0.1...

WordPress Custom Login and Registration plugin <= 1.0.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nguyen Ngoc Quang Bach maysbachs in WordPress Plugin Custom Login and Registration versions = 1.0.0...

WordPress WP HRM LITE plugin <= 1.1 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Hiro in WordPress Plugin WP HRM LITE versions = 1.1...

CVE-2025-46616

Quantum StorNext Web GUI API before 7.2.4 allows potential Arbitrary Remote Code Execution RCE via upload of a file. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and ActiveScale Cold Storage...

CVE-2025-32980

NETSCOUT nGeniusONE is affected by CVE-2025-32980 due to a weak sudo configuration in versions prior to 6.4.0 P11 b3245. The root cause is described as an improper sudo setup, enabling elevated privileges under certain conditions. Remediation per PT-2025-17938 indicates upgrading to version 6.4.0...

CVE-2025-32985

NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files...

CVE-2025-46544

CVE-2025-46544 affects Sherpa Orchestrator 141851. A low-privileged user can elevate privileges by creating new users and roles, as documented by multiple sources in connected documents. The vulnerability description is consistent across feeds; no exploits are provided in the documents. Some advi...

WordPress Prevent Direct Access – Protect WordPress Files plugin <= 2.8.8 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Tom Broucke in WordPress Plugin Prevent Direct Access versions = 2.8.8...

WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability

Server Side Request Forgery SSRF Vulnerability discovered by ch4r0n in WordPress Plugin WP AVCL Automation Helper formerly WPFlyLeads versions = 3.4...