Archive
4 November 2025
Vulnerabilities first published on this day (UTC), newest first.
147 results · Clear filters · Feed
-
Medium 6.0
CVE-2025-59596 is a denial-of-service vulnerability in Secure Access Windows client versions 12.0 to 14.10 that is addr…
-
Medium 5.3
ClipBucket v5: Stored XSS via Collection Tags
ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScrip…
-
Medium 5.3
MantisBT unauthorized disclosure of private project column configuration
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, due to insufficient access-level checks, any non-admin user with access to manage_config_columns_page.php can use the Copy From action to retrieve the columns configu…
-
Medium 5.4
MantisBT: Authentication bypass for some passwords due to PHP type juggling
Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions 2.27.1 and below, when a user edits their profile to change their e-mail address, the system saves it without validating that it actually belongs to the user. This could result in stor…
-
Medium 5.3
Galette is vulnerable to XSS through Document Type
Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0.
-
Medium 5.3
Galette is vulnerable to Cross-site Scripting
Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0.
-
Medium 6.2
NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communicati…
-
Medium 6.3
Kgateway transformation policy template can emit files from the container
## Summary The transformation policy template feature in Kgateway versions through 2.0.4 allows users with TrafficPolicy creation permissions to craft transformations that read and expose arbitrary files from the dataplane container filesystem. ## Description…
-
Medium 5.3
Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Man…
-
Medium 5.3
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows M…
-
Medium 6.5
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows C…
-
Medium 5.3
Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows…
-
Medium 5.3
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allo…
-
Medium 6.5
Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allo…
-
Medium 4.4
MeetingList <= 0.11 - Authenticated (Admin+) Stored Cross-Site Scripting
The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit…
-
Medium 5.9
Insecure configuration in DSPy lead to arbitrary file read when running untrusted code inside the sandbox
The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInterpreter” class.
-
Medium 6.4
Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy
The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the category and tag 'name' parameters in all versions up to, and including, 3.0.2 due to insuffic…
-
Medium 6.7
In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …
-
Medium 6.7
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 6.7
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 6.7
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esc…
-
Medium 6.7
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esc…
-
Medium 6.7
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 6.7
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 6.7
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 4.2
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 4.2
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 4.2
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 4.2
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local e…
-
Medium 4.2
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privileg…
-
Medium 4.2
In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privi…
-
Medium 4.2
In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of pr…
-
Medium 4.7
In wlan STA driver, there is a possible out of bounds read due to a race condition. This could lead to local informatio…
-
Medium 6.7CVE-2025-20730 Public exploit
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local es…
-
Medium 4.4
Clubmember <= 0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
The clubmember plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with …
-
Medium 6.4
Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Reuse Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'reuse_builder_single_post_title' shortcode in all versions up to, and including, 1.7. This is due to insufficient input sanitization and output escaping on the 'style…
-
Medium 4.4
Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
The Bootstrap Multi-language Responsive Portfolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible…
-
Medium 6.1
Associados Amazon Plugin <= 0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Associados Amazon Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the brzon_admin_panel() function. This makes it possible for unaut…
-
Medium 6.1
Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
The Visit Counter plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the widgets.php page. This makes it possible for unauthenticated attackers to update settings and inject…
-
Medium 4.4
Nari Accountant <= 1.0.12 - Authenticated (Editor+) Stored Cross-Site Scripting
The Nari Accountant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via account settings in all versions up to, and including, 1.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attack…