Recent Advisories

Severity ID Title Vendor Product Date Type
LOW 3.8 CVE-2025-10931

Umami Analytics – Moderately critical – Cross Site Scripting – SA-CONTRIB-2025-109_CVE-2025-10931

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scri...

Drupal Umami Analytics 0.0.0 CVE
LOW 3.5 CVE-2025-10636

NS Maintenance Mode for WP <= 1.3.1 - Admin+ Stored XSS_CVE-2025-10636

The NS Maintenance Mode for WP WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege u...

Unknown NS Maintenance Mode for WP CVE
LOW 2.1 CVE-2025-62787

Wazuh Vulnerable to Heap-based Buffer Over-read in DecodeWinevt_CVE-2025-62787

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.10.2, a buffer over-read occurs in DecodeW...

wazuh wazuh < 4.10.2 CVE
LOW 3.8 CVE-2025-62794

GitHub Workflow Updater stored the optional Github token in plaintext_CVE-2025-62794

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any ...

RichardoC github-workflow-updater-extension < 0.0.7 CVE
LOW 3.7 CVE-2025-10939

Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console_CVE-2025-10939

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The...

Red Hat Red Hat Build of Keycloak CVE
LOW 3.2 CVE-2025-11248

Sensitive Information Logged_CVE-2025-11248

ZohoCorp ManageEngine Endpoint Central versions prior to 11.4.2528.05 are vulnerable to a sensitive information logging issue. An authenticated use...

Zohocorp ManageEngine Endpoint Central CVE
LOW 2 CVE-2025-32785

Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field)_CVE-2025-32785

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole A...

pi-hole web < 6.3 CVE
LOW 1.2 CVE-2025-62779

Frappe Learning users were able to add HTML through input fields in the Job Form_CVE-2025-62779

Frappe Learning is a learning system that helps users structure their content. In Frappe Learning 2.39.1 and earlier, users were able to add HTML t...

frappe lms <= 2.39.1 CVE
LOW 1.3 CVE-2025-62778

Frappe Learning allowed students to access the Quiz Form via direct URL_CVE-2025-62778

Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to...

frappe lms <= 2.39.1 CVE
LOW 3.7 CVE-2025-11989

Missing Authorization in GitLab_CVE-2025-11989

GitLab has remediated an issue in GitLab EE affecting all versions from 17.6.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could...

GitLab GitLab 17.6.0 CVE