Cross-site scripting vulnerability in WordPress Event Booking Manager for WooCommerce

WordPress Event Booking Manager for WooCommerce versions 5.7.9 and earlier contain a cross-site scripting vulnerability. This flaw stems from improper handling of script-related HTML tags within web pages, making them susceptible to basic cross-site scripting attacks that could lead to code...

Esri ArcGIS Server authorization issue vulnerability

Versions 11.3 through 12.0 of Esri ArcGIS Server contain an authorization issue vulnerability. This vulnerability stems from improper permission control, allowing remote unauthenticated attackers to update service metadata...

Apple macOS buffer error vulnerability

Apple macOS Golden Gate versions prior to 27.2 contain a buffer error vulnerability stemming from an out-of-bounds write issue. Mounting a specially crafted disk image may lead to unintended system termination or corruption of kernel memory...

MISP Project misp-guard input validation error vulnerability

Versions 1.3 and earlier of the MISP Project’s misp-guard contain an input validation error vulnerability. This flaw arises from multiple policy execution checks that perform case-sensitive string comparisons on event tags, attribute categories, and shared group UUIDs. Attackers can exploit this ...

Zephyr Project Zephyr improper exception handling vulnerability

In Zephyr Project versions 4.4.0 through 4.5.0, there is an improper exception handling vulnerability. This vulnerability arises because SDP discovery requests cannot be canceled within the audio gateway role of classic Bluetooth headsets. After btrfcommdlcconnect fails, bthfpagconnect retains th...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to...

Wolfvision Cynap input validation error vulnerability

The Wolfvision Cynap contains an input validation error vulnerability stemming from issues with the shared encryption trust configuration for its file sharing functionality. This vulnerability may allow attackers who have obtained matching private keys to log in to affected devices via SSH using...

Yoosee gm8135s camera resource management error vulnerability

The Yoosee gm8135s camera running version 21.00.01.36 contains a resource management error vulnerability. This vulnerability stems from improper initialization of an unknown function within the file wpasupplicantX.conf in the WiFi Configuration component, potentially allowing local network...

Frappe CRM authorization issue vulnerability

Versions of Frappe CRM prior to 1.89.1 contain an authorization issue vulnerability. This flaw stems from a lack of proper authorization checks; authenticated users with low privileges can retrieve unreadable CRM Lead records by querying the getcontactbyphonenumber API. Since this API performs ra...

Wolfvision Cynap command injection vulnerability

Wolfvision Cynap has a command injection vulnerability stemming from improper handling of user-controlled input in its WolfProt interface implementation. This flaw may allow unauthenticated attackers with network access to execute operating system commands under the privileges of the affected...

Bukwild Decoy permission and access control issue vulnerability

Bukwild Decoy versions 5.11.1 and earlier contain a vulnerability related to permission escalation and access control. This issue stems from improper handling of the ‘role’ parameter in the Policy.php file, resulting in inadequate permission management and potential remote exploitation...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from issues in path processing logic, potentially allowing malicious Screen Sharing peers to...

XPDF input validation error vulnerability

Security vulnerabilities exist in xpdf versions 4.06 and earlier. These vulnerabilities stem from improper validation of the progression order field in JPEG 2000 images, potentially leading to infinite loops...

Libimobiledevice buffer error vulnerability

Versions 1.4.0 and earlier of libimobiledevice contain a buffer error vulnerability. This vulnerability stems from a heap buffer overflow in the webinspectorreceivewithtimeout function within the src/webinspector.c file of the Web Inspector component; it may be exploited by remote attackers...

Apple Safari security vulnerabilities

A security vulnerability exists in Apple Safari versions prior to 27.2, Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, and Apple visionOS versions prior to 27.2. This vulnerability stems from a type...

Agent2Agent A2A .NET SDK information disclosure vulnerability

Agent2Agent A2A .NET SDK versions 1.0.0-preview2 and earlier contain an information disclosure vulnerability. This vulnerability stems from improper handling in the A2AJsonRpcProcessor.ProcessRequestAsync function within the src/A2A.AspNetCore/A2AJsonRpcProcessor.cs file in the Parser component. ...

Geesondog Rhaphp server-side request forgery vulnerability

Geesondog Rhaphp has a server-side request forgery vulnerability. This vulnerability stems from improper handling of the ‘url’ parameter in the image function within the file application/mp/controller/Show.php in the Mp Module Media Proxy component, potentially leading to server-side request...

Apple Safari resource management error vulnerability

A resource management error vulnerability exists in Apple Safari versions prior to 27.2, Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple tvOS versions prior to 27.2, Apple visionOS versions prior to...

Sony neural network library input validation error vulnerability

Versions 1.39.0 and earlier of Sony’s neural network libraries contain a security vulnerability. This vulnerability stems from a code injection issue in the loadparamintxt function within the python/src/nnabla/utils/cli/encodedecodeparam.py file in the Encode Param Command Handler component,...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from a memory management issue involving use-after-free behavior, which may cause applications ...

NLnet Labs Routinator improper exception handling vulnerability

The NLnet Labs Routinator has a vulnerability related to improper exception handling. This occurs because the maximum value during AS range parsing is less than the minimum value, resulting in an inability to reach the maximum value and memory exhaustion...

Apple iOS security vulnerabilities

Security vulnerabilities exist in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to 27....

Argilla cross-site scripting vulnerability

Versions 2.8.0 and earlier of Argilla contain a security vulnerability. This vulnerability stems from improper handling of the ‘Name’ parameter in the Dataset.fromdisk function within the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue on the Settings Page component...

Apple macOS security vulnerabilities

A security vulnerability stemming from an out-of-bounds write issue exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability may lead to unintended system termination of applications ...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from improper permission handling and may allow malicious applications to read or write to...

Cheaper Inference OmniRoute authorization issue vulnerability

Versions 3.8.50 through 3.8.52 of Cheaper Inference OmniRoute contain an authorization issue vulnerability stemming from a lack of authentication. When requireLogin is disabled, unauthenticated attackers can issue synchronization tokens via POST /api/sync/tokens, and then use those tokens to obta...

lxsmnsyc seroval input validation error vulnerability

Versions of lxsmnsyc seroval prior to 1.6.8 contain a security vulnerability. This vulnerability arises because fromJSON and fromCrossJSON fail to validate the done index of sequence nodes. A specially crafted done index can create an iterator that never completes its iteration. When...

Kameleo information disclosure vulnerability

Versions 5.0.1.26 and earlier of Kameleo contain a security vulnerability. This vulnerability stems from improper handling within the ListProfiles function in the file client-engine-application/t.cs of the Profile Controller component; it may lead to information disclosure and can only be exploit...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from a logic issue that may allow applications to gain root privileges...

Apple iOS security vulnerabilities

Security vulnerabilities exist in Apple iOS versions prior to 26.7.2 and 27.2, Apple iPadOS versions prior to 26.7.2 and 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to 27....

DeepSeek Harness permission and access control issue vulnerability

Versions 0.2.0-rc.0, 0.2.0-rc.1, and 0.2.0-rc.2 of DeepSeek Harness contain a security vulnerability. This vulnerability stems from improper handling of the file packages/client/connection/src/browser-auth.ts by the Browser Auth component, leading to unauthorized authorization. Attackers can...

RT-Labs AB SOEM digital error vulnerability

Versions prior to RT-Labs AB SOEM 2.0.1 contain a security vulnerability. This vulnerability arises from insufficient validation when performing arithmetic operations on message length values; it allows negative numbers or extremely large values to bypass security checks. As a result, data...

Tiger Data pgvectorscale buffer error vulnerability

Versions of Tiger Data pgvectorscale prior to 0.9.1 contain a buffer error vulnerability stemming from type confusion. Low-privilege database users possessing CREATE privileges on the vectorscale schema can bypass pgvector’s vector types or operators by pre-creating shadow objects. This allows th...

NLnet Labs Routinator improper exception handling vulnerability

Versions of NLnet Labs Routinator prior to 0.15.3 contain an improper exception handling vulnerability. This flaw arises because incremental entries with gaps in RRDP notification files are still accepted and parsed, potentially leading to data loss. In cases where there are numerous such...

WordPress All In One Lightbox cross-site scripting vulnerability

WordPress All In One Lightbox versions 1.2.0 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during page generation, potentially enabling stored cross-site scripting attacks...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple tvOS versions prior to 27.2, Apple visionOS versions prior to 27.2, and Apple watchOS versions prior to 27.2. This vulnerability stems fr...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2. This vulnerability stems from improper handling of sensitive data movement, potentially allowing applications to access sensitive user data...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple iOS versions prior to 27.2, Apple iPadOS versions prior to 27.2, Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe...

Datadog ddtrace resource management error vulnerability

Datadog DDTrace versions from 1.5.0 up to 3.19.9 and from 4.0.0 up to 4.15.6 contain a resource management error vulnerability. This vulnerability arises from an excessive backtracking when the default query string is processed by regular expressions; it can allow remote attackers to cause...

vLLM improper exception handling vulnerability

Versions vLLM from 0.11.1 up to but not including 0.32.0 contain an improper exception handling vulnerability. This vulnerability arises because DeepSeek-OCR, DeepSeek-OCR-2, and Unlimited-OCR fail to properly handle normalized pixels and zero-valued images within their image paths. When such...

Apple iOS security vulnerabilities

A security vulnerability exists in Apple iOS versions prior to 26.7.2, Apple iPadOS versions prior to 26.7.2, Apple macOS Sequoia versions prior to 15.8.2, Apple macOS Tahoe versions prior to 26.7.2, Apple tvOS versions prior to 27.2, Apple visionOS versions prior to 27.2, and Apple watchOS...

Apple macOS security vulnerabilities

A security vulnerability exists in Apple macOS Golden Gate versions prior to 27.2, Apple macOS Sequoia versions prior to 15.8.2, and Apple macOS Tahoe versions prior to 26.7.2. This vulnerability stems from parsing issues in directory path handling, potentially allowing malicious applications to...

WordPress Better Post & Filter Widgets for Elementor authorization issue vulnerability

WordPress Better Post & Filter Widgets for Elementor versions 1.9.1 and earlier contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks, which may lead to exploitation of improperly configured access control security levels...

zip-rs zip path traversal vulnerability

A security vulnerability exists in zip-rs versions from 7.2.0 up to and including 9.0.0. This vulnerability stems from the use of lexical prefix comparison when validating symbolic link targets in ZipArchive::extract and ZipArchive::extractunwrappedrootdir; no intermediate links are parsed...

Crocoblock JetElements For Elementor cross-site scripting vulnerability

Crocoblock JetElements for Elementor versions 2.9.2.5 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation, potentially leading to stored cross-site scripting attacks...

WordPress Customer Coupons for WooCommerce authorization issue vulnerability

WordPress Customer Coupons for WooCommerce versions 1.3.14 and earlier contain an authorization issue vulnerability. This vulnerability stems from a lack of proper authorization checks, which may allow attackers to exploit improperly configured access control security levels...

Apple visionOS security vulnerabilities

A security vulnerability exists in Apple visionOS versions prior to 27.2. This vulnerability stems from improper input validation leading to an integer overflow, which may result in memory corruption when processing specially crafted 3D models...

Linux kernel security vulnerabilities

Security vulnerabilities exist in Linux kernel versions from 6.18.53 up to 6.18.57 and from 7.2.7 up to 7.2.11. These vulnerabilities arise when kernel page tables are delayed during bootup; the work queue is not yet initialized, potentially leading to null pointer dereferencing and kernel crashe...

Apache Camel information disclosure vulnerability

A information disclosure vulnerability exists in Apache Camel versions from 4.19.0 up to and including 4.22.2. This vulnerability stems from OAuthClientCredentialsTokenResolver within the OAuth component, which utilizes a static cache containing only token endpoints and client IDs as keys. It fai...