CVE-2025-31766

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plugin photoshelter-official-plugin allows Stored XSS.This issue affects PhotoShelter for Photographers Blog Feed Plugin: from n/a through =...

Security Bulletin: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients (CVE-2024-47535) affects IBM PowerVM Novalink.

Summary Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients is used by IBM PowerVM Novalink. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on...

AlmaLinux 8 : kernel (ALSA-2025:3260)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:3260 advisory. kernel: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array CVE-2025-21785 Tenable has extracted the preceding description block directly from the...

CBL Mariner 2.0 Security Update: php (CVE-2025-1219)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1219 advisory. - In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when...

CVE-2025-3059

Vulnerability in Drupal Profile Private.This issue affects Profile Private:...

CVE-2025-2794 Kentico Xperience <= 13.0.180 Unsafe Reflection

An unsafe reflection vulnerability in Kentico Xperience allows an unauthenticated attacker to kill the current process, leading to a Denial-of-Service condition. This issue affects Xperience: through 13.0.180...

CVE-2025-31567 WordPress Themesflat Addons For Elementor plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a through = 2.3.1...

CVE-2025-2977

A vulnerability was found in GFI KerioConnect 10.0.6. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component PDF File Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2025-22939

A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands...

CVE-2024-54803

NETGEAR WNR854T 1.5.2 (North America) is vulnerable to a Command Injection via the post.cgi file. The root cause is failure to filter constructed command characters in the nvram parameter pppoe_peer_mac within the pppoe_peer_mac function, allowing an attacker to input crafted data that can trigge...

BELL-CVE-2025-21878

Bulletin has no description...

CVE-2025-30918

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Gordon Böhme Structured Content structured-content allows Stored XSS.This issue affects Structured Content: from n/a through = 1.6.3...

RHEL 8 : kernel-rt (RHSA-2025:3211)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3211 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...

RHEL 9 : kernel-rt (RHSA-2025:3214)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:3214 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Securi...

CVE-2025-28921

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle-search allows Reflected XSS.This issue affects SpatialMatch IDX: from n/a through = 3.0.9...

CVE-2025-28093

ShopXO CVE-2025-28093 affects ShopXO v6.4.0 with a Server-Side Request Forgery (SSRF) in the Email Settings feature. Exploitation arises from insufficient validation of user-supplied URLs, enabling the server to initiate arbitrary outbound requests to internal or external resources. The CVSSv3.1 ...

Fedora 40 : nodejs-nodemon (2025-9a278a7768)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9a278a7768 advisory. Added patch for CVE-2024-4068 rhbz2280624 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

CVE-2025-28221

Tenda W6_S v1.0.0.4_510 is affected by a buffer overflow in the set_local_time function when processing the time parameter sent via POST, which can cause a web server crash and denial of service. Concrete detail: vulnerable component is the set_local_time handler; the vulnerability leads to avail...

CVE-2021-4454

In the Linux kernel, the following vulnerability has been resolved: can: j1939: fix errant WARNONONCE in j1939sessiondeactivate The conclusion "j1939sessiondeactivate should be called with a session ref-count of at least 2" is incorrect. In some concurrent scenarios, j1939sessiondeactivate can be...

CVE-2025-22640

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation allows Stored XSS.This issue affects Paytm Payment Donation: from n/a through = 2.3.3...