Administrator SQL Injection in Popup box <= 6.0.1 versions.

Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions.

Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS. This issue was remediated only on the `master` branch.

Contributor Cross Site Scripting (XSS) in StatCounter <= 2.1.1 versions.

Administrator SQL Injection in WP All Import <= 4.0.1 versions.

Subscriber Server Side Request Forgery (SSRF) in Kirki <= 6.0.11 versions.

Cross-Site Request Forgery (CSRF) vulnerability in MailPoet allows Cross Site Request Forgery. This issue affects MailPoet: from 5.30.0 through 5.33.0.

Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.

Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.

Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.

Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8.

Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.

Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_template is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment().

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.