CVE Vulnerability Catalog

In the Linux kernel on arm64, the return value from __change_memory_common is not propagated. Errors in set_memory_ro/set_memory_rox are suppressed, which can lead to incorrect rodata=on security state.

A vulnerability related to the handling of disconnected directories has been fixed in the Linux kernel. The issue was that access rights to files or directories opened through a disconnected directory were collected without considering the mount point, which could lead to inconsistent access results.

In the Linux kernel, the drm/panthor driver has a use-after-free vulnerability in the GROUP_CREATE function. A malicious user can call GROUP_DESTROY from another thread before GROUP_CREATE completes, leading to use of freed memory.

W podatności CVE-2025-68608 występuje brak autoryzacji w wtyczce Userpro od DeluxeThemes, co pozwala na wykorzystanie nieprawidłowo skonfigurowanych poziomów kontroli dostępu. Problem dotyczy wersji Userpro od n/a do 5.1.9.

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPXPO PostX ultimate-post allows Retrieve Embedded Sensitive Data. This issue affects PostX from n/a through <= 5.0.3.

The Post Grid and Gutenberg Blocks plugin up to version 2.3.23 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.

The Editorial Calendar plugin up to version 3.8.8 contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The WordPress plugin 'Accept Donations with PayPal & Stripe' up to version 1.5.2 has an Open Redirect vulnerability that could be used for phishing.

A Cross-Site Request Forgery (CSRF) vulnerability in the Rustaurius Five Star Restaurant Reservations WordPress plugin (restaurant-reservations). This issue affects Five Star Restaurant Reservations versions from n/a through 2.7.8.

The Yannick Lefebvre WordPress Link Library plugin (link-library) contains a Server-Side Request Forgery (SSRF) vulnerability. This issue affects versions from n/a through 7.8.7. The vulnerability may allow an attacker to force the server to make requests to arbitrary resources.

The YouTube Embed plugin up to version 5.4 contains a Stored Cross-site Scripting (XSS) vulnerability that allows an attacker to inject a persistent script into the website.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer (live-composer-page-builder) allows Stored XSS. This issue affects Page Builder: Live Composer from n/a through 2.1.22.

The Jobs for WordPress plugin is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through 2.8.1.

The Bit Assist plugin (versions up to and including 1.5.11) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Bit Assist from n/a through 1.5.11.

The Widgets for Social Photo Feed plugin (versions up to and including 1.8) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects Widgets for Social Photo Feed from n/a through 1.8.

Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage (social-polls-by-opinionstage) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Poll, Survey & Quiz Maker Plugin by Opinion Stage: from n/a through <= 19.12.0.

Missing Authorization vulnerability in WP Adminify (through version 4.0.6.1) allows exploiting incorrectly configured access control security levels.

Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Adminify from n/a through <= 4.0.6.1.

Missing Authorization vulnerability in Simple File List (through version 6.1.18) allows exploiting incorrectly configured access control security levels.

W podatności CVE-2025-68590 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniu SQL, co prowadzi do możliwości przeprowadzenia ataku typu Blind SQL Injection w integracji CRM Perks dla wtyczki Contact Form 7 HubSpot. Problem dotyczy wersji od n/a do 1.4.2 włącznie.