WordPress Shopo Theme <= 1.1.4 is vulnerable to Arbitrary File Upload

Software Shopo Type Theme Vulnerable versions = 1.1.4 Fixed in N/A OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2025-31048 Patch priority Medium CVSS severity Medium 9.9 Developer Claim ownership PSID 148bf5acafb9 Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

python314-3.14.0~rc1-2.1 on GA media (moderate)

python314-3.14.0rc1-2.1 on GA media Announcement ID: openSUSE-SU-2025:15403-1 Rating: moderate Cross-References: CVE-2025-8194 CVSS scores: CVE-2025-8194 SUSE : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2025-8194 SUSE : 7.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:...

Linux Distros Unpatched Vulnerability : CVE-2025-21999

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - proc: fix UAF in procgetinode Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde-procops don't belong to /proc, it belongs to a...

Linux Distros Unpatched Vulnerability : CVE-2020-15665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Firefox did not reset the address bar after the beforeunload dialog was shown if the user chose to remain on the page. This could have resulted in an incorrect...

CVE-2025-8510 Portabilis i-Educar educar_matricula_lst.php Gerar cross site scripting

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educarmatriculalst.php. The manipulation of the argument refcodaluno leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2025-6722 BitFire <= 4.5 - Unauthenticated Information Exposure

The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire directory that automatically gets created and stores potentially sensitive files without any access...

WordPress Image Gallery plugin <= 1.0.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin Image Gallery versions = 1.0.0...

WordPress Custom Word Cloud plugin <= 0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via angle Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via angle Parameter vulnerability discovered by muhammad yudha in WordPress Plugin Custom Word Cloud versions = 0.3...

CVE-2025-5999

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s token privileges to Vault’s root policy. Fixed in Vault Community Edition 1.20.0 and Vault Enterprise 1.20.0, 1.19.6, 1.18.11 and 1.16.22...

CVE-2025-7646 The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter in all versions up to, and including, 6.3.10 even when the user does not have the unfilteredhtml...

CVE-2025-54939

LiteSpeed QUIC LSQUIC Library before 4.3.1 has an lsquicenginepacketin memory leak...

WordPress Service Finder SMS System plugin <= 2.0.0 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Foxyyy in WordPress Plugin Service Finder SMS System versions = 2.0.0...

WordPress April Framework plugin <= 5.1 - Missing Authorization to Authenticated (Subscriber+) Settings Updates vulnerability

Missing Authorization to Authenticated Subscriber+ Settings Updates vulnerability discovered by Lucio Sá in WordPress Plugin April Framework versions = 5.1...

WordPress Benaa Framework plugin <= 4.0.0 - Authenticated (Subscriber+) Arbitrary File Upload

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by Lucio Sá in WordPress Plugin Benaa Framework versions = 4.0.0...

WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting vulnerability

Authenticated GiveWP worker+ Stored Cross-Site Scripting vulnerability discovered by Brian Sans-Souci liardom in WordPress Plugin GiveWP versions = 4.5.0...

CVE-2025-8258

A vulnerability, which was classified as problematic, has been found in Cool Mo Maigcal Number App up to 1.0.3 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml of the component com.sdmagic.number. The manipulation leads to improper export of android...

CVE-2025-4424

The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/productsecurity/home...

CVE-2025-4426

The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/productsecurity/home...

CVE-2025-4421

The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/productsecurity/home...

RockyLinux 8 : kernel-rt (RLSA-2025:3027)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:3027 advisory. kernel: can: bcm: Fix UAF in bcmprocshow CVE-2023-52922 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Note...