CLSA-2026-1774002757 Fix CVE(s): CVE-2026-25898

SECURITY UPDATE: global buffer overflow read in UIL and XPM encoders. - debian/patches/CVE-2026-25898.patch: clamp negative pixel index values to zero in WriteUILImage, WritePICONImage, and WriteXPMImage before using them as array subscripts into the Cixel table. - CVE-2026-25898...

CVE-2026-28393

OpenClaw versions 2.0.0-beta3 prior to 2026.2.14 contain a path traversal vulnerability in hook transform module loading that allows arbitrary JavaScript execution. The hooks.mappings.transform.module parameter accepts absolute paths and traversal sequences, enabling attackers with configuration...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the DeleteBranchPost function. A repository collaborator with Write permission can delete protected branches or the default branch by sending POST requests directly to the web interface, bypassing branch...

Siemens SIMATIC S7-1500 Use After Free (CVE-2025-39689)

In the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of setftracefilter and setftracenotrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy...

PT-2025-51882

Name of the Vulnerable Software and Affected Versions AWS SDK for PHP versions prior to 3.368.0 Description A missing cryptographic key commitment in the AWS SDK for PHP could allow a user with write access to an S3 bucket to introduce a new Encryption Data Key EDK that decrypts to different...

CVE-2025-64994

A privilege escalation vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate...

EUVD-2017-0165

Malware in sbrugna...

EUVD-2025-3348

Malicious code in bioql PyPI...

CVE-2025-3597

The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery Metadata library is enabled. While this feature is meant to only be available to Pro version users, it can be activated in the free versi...

CVE-2025-23692

Cross-Site Request Forgery CSRF vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through = 1.3...

CVE-2025-23692

Cross-Site Request Forgery CSRF vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through = 1.3...

CVE-2025-23692

Cross-Site Request Forgery CSRF vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through = 1.3...

CVE-2025-23692

CVE-2025-23692 : CSRF in Slider for Writers allows stored XSS. Affected: Artem Anikeev Slider for Writers, versions up to 1.3 (reported as from n/a through 1.3). Public details in connected sources corroborate the CSRF-to-XSS flow but do not disclose a patch or mitigation in the provided documents.

CVE-2025-23692 WordPress Slider for Writers plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in artanik Slider for Writers slider-for-writers allows Stored XSS.This issue affects Slider for Writers: from n/a through = 1.3...

WordPress Slider for Writers plugin <= 1.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Slider for Writers versions = 1.3...

WordPress plugin Slider for Writers 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

PT-2025-5027 · Unknown · Slider For Writers

Name of the Vulnerable Software and Affected Versions: Slider for Writers versions n/a through 1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

CVE-2024-8118 Grafana alerting wrong permission on datasource rule write endpoint

In Grafana, the wrong permission is applied to the alert rule write API endpoint, allowing users with permission to write external alert instances to also write alert rules...

Malicious code in Be.Vlaanderen.Basisregіsters.RoadRegistrу.BackOffice.ZiрArchiveWrіters (NuGet)

--- -= Per source details. Do not edit below this line.=-...

UBUNTU-CVE-2023-52672

In the Linux kernel, the following vulnerability has been resolved: pipe: wakeup wrwait after setting maxusage Commit c73be61cede5 "pipe: Add general notification queue support" a regression was introduced that would lock up resized pipes under certain conditions. See the reproducer in 1. The...