484 matches found
CVE-2025-60181
Server-Side Request Forgery SSRF vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through = 0.6...
CVE-2025-60181 WordPress Silencesoft RSS Reader Plugin <= 0.6 - Server Side Request Forgery (SSRF) Vulnerability
Server-Side Request Forgery SSRF vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Server Side Request Forgery.This issue affects Silencesoft RSS Reader: from n/a through = 0.6...
CVE-2025-60181
CVE-2025-60181 is a Server-Side Request Forgery (SSRF) in Silencesoft RSS Reader (WordPress plugin Silencesoft RSS Reader, <=0.6). Public details in the initial document indicate an SSRF vulnerability with a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N and a base score of 5.4 (Mediu...
PT-2025-39617
Name of the Vulnerable Software and Affected Versions Silencesoft RSS Reader versions through 0.6 Description A Server-Side Request Forgery SSRF issue exists in Silencesoft RSS Reader. This allows for Server Side Request Forgery. Recommendations At the moment, there is no information about a newe...
CVE-2025-26278
A prototype pollution in the lib.set function of dref v0.1.2 allows attackers to cause a Denial of Service DoS via supplying a crafted payload...
git-commiters.js 安全漏洞
git-commiters.js is a js library by Riceball LEE Individual Developers. A security vulnerability exists in git-commiters.js versions prior to 0.1.2, which stems from not cleaning up user input and not securely executing the process API, which could lead to a command injection attack...
WordPress Author: Munzir plugin <= 0.9 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Author: Munzir versions = 0.9...
CVE-2025-10157 PickleScan Bypasses Unsafe Globals Check Using Submodule Imports
A Protection Mechanism Failure vulnerability in mmaitre314 picklescan versions up to and including 0.0.30 allows a remote attacker to bypass the unsafe globals check. This is possible because the scanner performs an exact match for module names, allowing malicious payloads to be loaded via...
Linux Distros Unpatched Vulnerability : CVE-2022-23638
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - svg-sanitizer is a SVG/XML sanitizer written in PHP. A cross-site scripting vulnerability impacts all users of the svg-sanitizer library prior to version 0.15.0...
PT-2025-36485
Name of the Vulnerable Software and Affected Versions: Avigilon ACM version 7.10.0.20 Description: A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. Recommendations: At the moment, there is no information about...
PT-2025-36503
Name of the Vulnerable Software and Affected Versions: @akoskm/create-mcp-server-stdio versions prior to 0.0.13 Description: The @akoskm/create-mcp-server-stdio package, a MCP server starter kit utilizing the StdioServerTransport, contains a command injection issue in versions prior to 0.0.13. Th...
Malicious code in openmct-e2e (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 929c26f533affbdfe0c09be2dff86f393cae1b379f25ce110aa61a1a27f473fb The OpenSSF Package Analysis project identified 'openmct-e2e' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...
Linux Distros Unpatched Vulnerability : CVE-2025-29785
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to...
CVE-2025-48303
Cross-Site Request Forgery CSRF vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affects Post Type Converter: from n/a through = 0.6...
CVE-2025-48303 WordPress Post Type Converter plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in Kevin Langley Jr. Post Type Converter post-type-converter allows Cross Site Request Forgery.This issue affects Post Type Converter: from n/a through = 0.6...
WordPress WP Filter & Combine RSS Feeds plugin <= 0.4 - Missing Authorization to Authenticated (Contributor+) Feed Deletion vulnerability
Missing Authorization to Authenticated Contributor+ Feed Deletion vulnerability discovered by ch4r0n in WordPress Plugin WP Filter & Combine RSS Feeds versions = 0.4...
CVE-2025-52287
OperaMasks SDK ELite Script Engine v0.5.0 was discovered to contain a deserialization vulnerability...
Agent Zero 安全漏洞
Agent Zero is an artificial intelligence framework by the individual developer Jan Tomášek. A security vulnerability exists in Agent Zero version v0.8, which stems from improper permissions and could lead to a system reset...
CVE-2025-55523
An issue in the component /api/downloadworkdirfile.py of Agent-Zero v0.8. allows attackers to execute a directory traversal...
Spree Commerce is vulnerable to RCE through Search API
Spreecommerce versions prior to 0.50.x contain a remote command execution vulnerability in the API's search functionality. Improper input sanitation allows attackers to inject arbitrary shell commands via the searchinstanceeval parameter, which is dynamically invoked using Ruby’s send method. Thi...