115078 matches found
PT-2025-52873
Name of the Vulnerable Software and Affected Versions Mattermost versions 10.11.x through 10.11.7 Mattermost versions 10.12.x through 10.12.3 Mattermost versions 11.0.x through 11.0.5 Mattermost versions 11.1.x through 11.1.0 Description Mattermost fails to verify that post actions invoking...
WordPress plugin SALESMANAGO security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
WordPress plugin: Subscribe to Unlock Lite security vulnerabilities
...
PT-2025-53088
Name of the Vulnerable Software and Affected Versions WpStream versions through 4.9.5 Description A missing authorization issue exists in WpStream, allowing exploitation of incorrectly configured access control security levels. Recommendations Update WpStream to a version newer than 4.9.5...
PT-2025-52870
Name of the Vulnerable Software and Affected Versions Gravity Forms WordPress plugin versions prior to 2.9.23.1 Description The Gravity Forms WordPress plugin does not properly prevent users from uploading dangerous files through its chunked upload functionality. This allows attackers to upload P...
@aafe/ai-test (>=0.0.1, <=0.0.2), @acabai/android (>=1.0.0, <=2.0.6) +861 more potentially affected by CVE-2025-68665 via @langchain/core (>=0.0.0, <=0.3.79)
@langchain/core NPM version =0.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.5, =0.1.0, =0.1.2, =0.0.1, =1.2.27, =0.1.7, =3.0.0-beta.65.0, =8.0.0, =11.0.0 and more Source cves: CVE-2025-68665 Source advisory: SNYK:JS-LANGCHAINCORE-14563113...
CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction
LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON method and subsequently when string-ifying objects using...
CVE-2025-68664 LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
LangChain is a framework for building agents and LLM-powered applications. Prior to versions 0.3.81 and 1.2.5, a serialization injection vulnerability exists in LangChain's dumps and dumpd functions. The functions do not escape dictionaries with 'lc' keys when serializing free-form dictionaries...
CVE-2025-68617
CVE-2025-68617 – FluidSynth: A race condition during unloading of a DLS file can trigger a heap-based use-after-free in FluidSynth versions 2.5.0 to before 2.5.2. If a DLS unload is concurrent with synthesizer destruction or if samples from the unloaded DLS are used by active voices, freed memory...
CVE-2025-66209 Coolify Vulnerable to Authenticated Remote Code Execution via Command Injection in Database Backup
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.451, an authenticated command injection vulnerability in the Database Backup functionality allows users with application/service management permissions to execute...
CVE-2025-68114
Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStreamconcat lets a malicious csoptmem.vsnprintf drive SStream’s index negative or past the end, leading to a stack buffer underflow/overflow when the next write occurs. Commit...
@aafe/ai-test (>=0.0.1, <=0.0.2), @acabai/android (>=1.0.0, <=2.0.6) +861 more potentially affected by CVE-2025-68665 via @langchain/core (>=0.0.0, <=0.3.79)
@langchain/core NPM version =0.0.0, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.5, =0.1.0, =0.1.2, =0.0.1, =1.2.27, =0.1.7, =3.0.0-beta.65.0, =8.0.0, =11.0.0 and more Source cves: CVE-2025-68665 Source advisory: OSV:GHSA-R399-636X-V7F6...
CVE-2025-25364
A command injection vulnerability in the me.connectify.SMJobBlessHelper XPC service of Speedify VPN up to v15.0.0 allows attackers to execute arbitrary commands with root-level privileges...
WordPress WP JobHunt plugin <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference vulnerability
Authenticated Candidate+ Insecure Direct Object Reference vulnerability discovered by meghnine islem - CYBEARS in WordPress Plugin WP JobHunt versions = 7.7...
WordPress Brave plugin <= 0.8.3 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by daroo in WordPress Plugin Brave versions = 0.8.3...
RSEC-2025-1 Risk of __proto__ pollution Vulnerability
The plotly R package up through the latest 4.11.0 includes plotly.js library 2.11.1. Plotly.js releases prior to version 2.25.2 have a risk of proto being polluted in expandObjectPaths or nestedProperty...
WordPress Responsive Posts Carousel Pro plugin <= 15.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Responsive Posts Carousel Pro versions = 15.2...
WordPress WPBulky plugin <= 1.1.13 - SQL Injection vulnerability
SQL Injection vulnerability discovered by benzdeus in WordPress Plugin WPBulky versions = 1.1.13...