Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ation about service activity or uptime. This issue is fixed in version 1.71.0 . To workaround the vulnerability, use a load-balancer or application level firewall in order to block the request route /api/v1/usage-report/summary. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/treeverse/lakeFS/security/advisories/GHSA-h238-5mwf-8xw8 - https://github.com/treeverse/lakeFS/commit/1c8adab852dac2387fcb00a256402b308a610c60
CVE ID: CVE-2025-64180 State: PUBLISHED Published: 2025-11-07T02:58:44.575Z Last Updated: 2025-11-07T02:58:44.575Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Manager-io Products: Manager Problem Types: CWE-367, CWE-918 Description: Manager-io/Manager is accounting software. In Manager Desktop and Server versions 25.11.1.3085 and below, a critical vulnerability permits unauthorized access to internal network resources. The flaw lies in the fundamental design of the DNS validation mechanism. A Time-of-Check Time-of-Use (TOCTOU) condition that allows attackers to bypass network isolation and access internal services, cloud metadata endpoints, and protecte
n that allows attackers to bypass network isolation and access internal services, cloud metadata endpoints, and protected network segments. The Desktop edition requires no authentication; the Server edition requires only standard authentication. This issue is fixed in version 25.11.1.3086. References: - https://github.com/Manager-io/Manager/security/advisories/GHSA-j2xj-xhph-p74j
CVE ID: CVE-2025-64181 State: PUBLISHED Published: 2025-11-10T21:23:04.248Z Last Updated: 2025-11-12T21:05:26.971Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-457 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing `openexr_exrcheck_fuzzer`, Valgrind reports a conditional branch depending on uninitialized data inside `generic_unpack`. This indicates a use of uninitialized memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3
memory. The issue can result in undefined behavior and/or a potential crash/denial of service. Versions 3.3.6 and 3.4.3 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-3h9h-qfvw-98hq - https://github.com/user-attachments/files/23024726/archive0.zip - https://github.com/user-attachments/files/23024736/archive1.zip - https://github.com/user-attachments/files/23024740/archive2.zip - https://github.com/user-attachments/files/23024744/archive3.zip - https://github.com/user-attachments/files/23024746/archive4.zip
CVE ID: CVE-2025-64182 State: PUBLISHED Published: 2025-11-10T21:27:21.176Z Last Updated: 2025-11-14T19:22:58.166Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-120 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter (the deprecated OpenEXR.InputFile wrapper) allow crashes and likely code execution when opening attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in Inpu
attacker-controlled EXR files or when passing crafted Python objects. Integer overflow and unchecked allocation in InputFile.channel() and InputFile.channels() can lead to heap overflow (32 bit) or a NULL deref (64 bit). Versions 3.2.5, 3.3.6, and 3.4.3 contain a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-vh63-9mqx-wmjr - https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L528-L536
CVE ID: CVE-2025-64183 State: PUBLISHED Published: 2025-11-10T21:29:54.234Z Last Updated: 2025-11-14T18:38:32.682Z Vendors: AcademySoftwareFoundation Products: openexr Problem Types: CWE-416 Description: OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, there is a use-after-free in PyObject_StealAttrString of pyOpenEXR_old.cpp. The legacy adapter defines PyObject_StealAttrString that calls PyObject_GetAttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling po
ttrString to obtain a new reference, immediately decrefs it, and returns the pointer. Callers then pass this dangling pointer to APIs like PyLong_AsLong/PyFloat_AsDouble, resulting in a use-after-free. This is invoked in multiple places (e.g., reading PixelType.v, Box2i, V2f, etc.) Versions 3.2.5, 3.3.6, and 3.4.3 fix the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-57cw-j6vp-2p9m - https://github.com/AcademySoftwareFoundation/openexr/blob/b3a19903db0672c63055023aa788e592b16ec3c5/src/wrappers/python/PyOpenEXR_old.cpp#L109-L115
CVE ID: CVE-2025-64184 State: PUBLISHED Published: 2025-11-07T03:02:41.838Z Last Updated: 2025-11-07T18:02:26.896Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: webcomics Products: dosage Problem Types: CWE-22 Description: Dosage is a comic strip downloader and archiver. When downloading comic images in versions 3.1 and below, Dosage constructs target file names from different aspects of the remote comic (page URL, image URL, page content, etc.). While the basename is properly stripped of directory-traversing characters, the file extension is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is serve
is taken from the HTTP Content-Type header. This allows a remote attacker (or a Man-in-the-Middle, if the comic is served over HTTP) to write arbitrary files outside the target directory (if additional conditions are met). This issue is fixed in version 3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/webcomics/dosage/security/advisories/GHSA-4vcx-3pj3-44m7 - https://github.com/webcomics/dosage/commit/336a9684191604bc49eed7296b74bd582151181e
CVE ID: CVE-2025-64185 State: PUBLISHED Published: 2025-11-20T16:58:01.527Z Last Updated: 2025-11-21T16:57:10.499Z Vendors: OSC Products: ondemand Problem Types: CWE-277, CWE-552 Description: Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, Open OnDemand packages create world writable locations in the GEM_PATH. Open OnDemand versions 4.0.8 and 3.1.16 have been patched for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OSC/ondemand/security/advisories/GHSA-r2cg-hg78-gq9p
CVE ID: CVE-2025-64186 State: PUBLISHED Published: 2025-11-12T20:34:04.321Z Last Updated: 2025-11-14T17:40:17.728Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: evervault Products: evervault-go Problem Types: CWE-347 Description: Evervault is a payment security solution. A vulnerability was identified in the `evervault-go` SDK’s attestation verification logic in versions of `evervault-go` prior to 1.3.2 that may allow incomplete documents to pass validation. This may cause the client to trust an enclave operator that does not meet expected integrity guarantees. The exploitability of this issue is limited in Evervault-hosted environments as an attacker would
integrity guarantees. The exploitability of this issue is limited in Evervault-hosted environments as an attacker would require the pre-requisite ability to serve requests from specific evervault domain names, following from our ACME challenge based TLS certificate acquisition pipeline. The vulnerability primarily affects applications which only check PCR8. Though the efficacy is also reduced for applications that check all PCR values, the impact is largely remediated by checking PCR 0, 1 and 2. The identified issue has been addressed in version 1.3.2 by validating attestation documents before storing in the cache, and replacing the naive equality checks with a new SatisfiedBy check. Those w
ion documents before storing in the cache, and replacing the naive equality checks with a new SatisfiedBy check. Those who useevervault-go to attest Enclaves that are hosted outside of Evervault environments and cannot upgrade have two possible workarounds available. Modify the application logic to fail verification if PCR8 is not explicitly present and non-empty and/or add custom pre-validation to reject documents that omit any required PCRs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/evervault/evervault-go/security/advisories/GHSA-88h9-77c7-p6w4 - https://github.com/evervault/evervault-go/pull/48 - https://github.com/evervault/evervault-go/commit/7c
88h9-77c7-p6w4 - https://github.com/evervault/evervault-go/pull/48 - https://github.com/evervault/evervault-go/commit/7c824d289bba11ec0bea46a338023f5b128bbb28
CVE ID: CVE-2025-64187 State: PUBLISHED Published: 2025-11-07T03:11:34.227Z Last Updated: 2025-11-07T17:59:07.039Z Vendors: OctoPrint Products: OctoPrint Problem Types: CWE-80 Description: OctoPrint provides a web interface for controlling consumer 3D printers. Versions 1.11.3 and below are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Action Command notifications and prompts popups generated by the printer. An attacker who successfully convinces a victim to print a specially crafted file could exploit this issue to disrupt ongoing prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissi
prints, extract information (including sensitive configuration settings, if the targeted user has the necessary permissions for that), or perform other actions on behalf of the targeted user within the OctoPrint instance. This issue is fixed in version 1.11.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-crvm-xjhm-9h29 - https://github.com/OctoPrint/OctoPrint/commit/9112e07b1085f4c1ee9eefc67985809251057a44
CVE ID: CVE-2025-64194 State: PUBLISHED Published: 2025-10-29T08:38:03.614Z Last Updated: 2025-11-19T14:42:08.707Z Vendors: ThimPress Products: Eduma Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/eduma/vulnerability/wordpress-eduma-theme-5-7-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64195 State: PUBLISHED Published: 2025-10-29T08:38:04.034Z Last Updated: 2025-11-18T14:39:19.435Z Vendors: ThimPress Products: Eduma Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress Eduma eduma allows PHP Local File Inclusion.This issue affects Eduma: from n/a through <= 5.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/eduma/vulnerability/wordpress-eduma-theme-5-7-6-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64196 State: PUBLISHED Published: 2025-11-06T15:56:07.302Z Last Updated: 2025-11-13T10:33:49.301Z Vendors: Pluggabl Products: Booster for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.This issue affects Booster for WooCommerce: from n/a through <= 7.2.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/woocommerce-jetpack/vulnerability/wordpress-booster-for-woocommerce-plugin-7-2-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64197 State: PUBLISHED Published: 2025-10-29T08:38:04.636Z Last Updated: 2025-11-18T14:38:59.542Z Vendors: sizam Products: Rehub Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/rehub-theme/vulnerability/wordpress-rehub-theme-19-9-9-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64198 State: PUBLISHED Published: 2025-11-06T15:56:09.273Z Last Updated: 2025-11-13T10:33:49.351Z Vendors: appscreo Products: Easy Social Share Buttons Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Easy Social Share Buttons easy-social-share-buttons3 allows Reflected XSS.This issue affects Easy Social Share Buttons: from n/a through < 10.7.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/easy-social-share-buttons3/vulnerability/wordpress-easy-social-share-buttons-plugin-10-7-1-cross-site-scripting-xss-vuln
easy-social-share-buttons3/vulnerability/wordpress-easy-social-share-buttons-plugin-10-7-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64199 State: PUBLISHED Published: 2025-10-29T08:38:05.202Z Last Updated: 2025-11-18T14:38:42.701Z Vendors: WpEstate Products: wpresidence Problem Types: CWE-862 Description: Missing Authorization vulnerability in WpEstate wpresidence wpresidence allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpresidence: from n/a through <= 5.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/wpresidence/vulnerability/wordpress-wpresidence-theme-5-3-2-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64200 State: PUBLISHED Published: 2025-10-29T08:38:05.654Z Last Updated: 2025-11-13T10:33:49.274Z Vendors: VillaTheme Products: Email Template Customizer for WooCommerce Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for WooCommerce: from n/a through <= 1.2.17. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/email-template-customizer-for-woo/vulnerability/wordpress-email
: - https://vdp.patchstack.com/database/Wordpress/Plugin/email-template-customizer-for-woo/vulnerability/wordpress-email-template-customizer-for-woocommerce-plugin-1-2-17-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64201 State: PUBLISHED Published: 2025-10-29T08:38:06.132Z Last Updated: 2025-11-13T10:33:49.293Z Vendors: blubrry Products: PowerPress Podcasting Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through <= 11.13.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/powerpress/vulnerability/wordpress-powerpress-podcasting-plugin-11-13-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2025-64202 State: PUBLISHED Published: 2025-10-29T08:38:06.577Z Last Updated: 2025-11-13T10:33:49.339Z Vendors: TieLabs Products: Sahifa Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Sahifa sahifa allows DOM-Based XSS.This issue affects Sahifa: from n/a through < 5.8.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/sahifa/vulnerability/wordpress-sahifa-theme-5-8-6-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64204 State: PUBLISHED Published: 2025-10-29T08:38:07.091Z Last Updated: 2025-11-13T10:33:49.303Z Vendors: ThemeSphere Products: SmartMag Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeSphere SmartMag smart-mag allows Stored XSS.This issue affects SmartMag: from n/a through <= 10.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/smart-mag/vulnerability/wordpress-smartmag-theme-10-3-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64208 State: PUBLISHED Published: 2025-10-29T08:38:07.521Z Last Updated: 2025-11-13T10:33:49.259Z Vendors: TieLabs Products: Jannah - Extensions Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah - Extensions jannah-extensions allows DOM-Based XSS.This issue affects Jannah - Extensions: from n/a through <= 1.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/jannah-extensions/vulnerability/wordpress-jannah-extensions-plugin-1-1-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64210 State: PUBLISHED Published: 2025-10-29T08:38:07.975Z Last Updated: 2025-11-13T10:33:49.316Z Vendors: StylemixThemes Products: Masterstudy Elementor Widgets Problem Types: CWE-862 Description: Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/masterstudy-elementor-widgets/vulnerability/wordpress-masterstudy-elementor-widgets-plugin-1-2-4-broken-
ordpress/Plugin/masterstudy-elementor-widgets/vulnerability/wordpress-masterstudy-elementor-widgets-plugin-1-2-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64211 State: PUBLISHED Published: 2025-10-29T08:38:08.406Z Last Updated: 2025-11-13T10:33:49.242Z Vendors: StylemixThemes Products: Masterstudy Elementor Widgets Problem Types: CWE-862 Description: Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masterstudy Elementor Widgets: from n/a through <= 1.2.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/masterstudy-elementor-widgets/vulnerability/wordpress-masterstudy-elementor-widgets-plugin-1-2-4-broken-access-c
/Plugin/masterstudy-elementor-widgets/vulnerability/wordpress-masterstudy-elementor-widgets-plugin-1-2-4-broken-access-control-vulnerability-2?_s_id=cve
CVE ID: CVE-2025-64212 State: PUBLISHED Published: 2025-10-29T08:38:08.827Z Last Updated: 2025-11-13T10:33:49.286Z Vendors: StylemixThemes Products: MasterStudy LMS Pro Problem Types: CWE-862 Description: Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro masterstudy-lms-learning-management-system-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS Pro: from n/a through < 4.7.16. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/masterstudy-lms-learning-management-system-pro/vulnerability/wordpress-masterstudy-lms-pro-plugin-4-7-16-broken-acces
in/masterstudy-lms-learning-management-system-pro/vulnerability/wordpress-masterstudy-lms-pro-plugin-4-7-16-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64216 State: PUBLISHED Published: 2025-10-29T08:38:09.280Z Last Updated: 2025-11-13T10:33:49.244Z Vendors: ThemeSphere Products: SmartMag Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeSphere SmartMag smart-mag allows PHP Local File Inclusion.This issue affects SmartMag: from n/a through <= 10.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Theme/smart-mag/vulnerability/wordpress-smartmag-theme-10-3-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2025-64219 State: PUBLISHED Published: 2025-10-29T08:38:09.728Z Last Updated: 2025-11-13T10:33:49.294Z Vendors: Strategy11 Team Products: Business Directory Problem Types: CWE-862 Description: Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.18. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/business-directory-plugin/vulnerability/wordpress-business-directory-plugin-6-4-18-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2025-64220 State: PUBLISHED Published: 2025-10-29T08:38:10.174Z Last Updated: 2025-11-13T10:33:49.354Z Vendors: ReyCommerce Products: Rey Core Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReyCommerce Rey Core rey-core allows Stored XSS.This issue affects Rey Core: from n/a through <= 3.1.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/rey-core/vulnerability/wordpress-rey-core-plugin-3-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64224 State: PUBLISHED Published: 2025-11-06T15:56:10.204Z Last Updated: 2025-11-13T10:33:49.272Z Vendors: ThemeGoods Products: Grand Conference Theme Custom Post Type Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Reflected XSS.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme
/vdp.patchstack.com/database/Wordpress/Plugin/grandconference-custom-post/vulnerability/wordpress-grand-conference-theme-custom-post-type-plugin-2-6-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2025-64226 State: PUBLISHED Published: 2025-10-29T08:38:10.612Z Last Updated: 2025-11-13T10:33:49.295Z Vendors: colabrio Products: Stockie Extra Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: from n/a through <= 1.2.11. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vdp.patchstack.com/database/Wordpress/Plugin/stockie-extra/vulnerability/wordpress-stockie-extra-plugin-1-2-11-cross-site-request-forgery-csrf-vulnerability?_s_id=cve