The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcode. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'dreampluginsmain' AJAX action. This makes it possible for unauthenticated attackers to update the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2025-29933 is a medium severity vulnerability in AMD μProf caused by improper input validation leading to an out-of-bounds write. This flaw allows a local attacker with limited privileges to write outside intended memory bounds, potentially causing application crashes or denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. Exploitation requires local access and no user interaction, limiting remote attack feasibility. No known exploits are currently reported in the wild. European organizations using AMD μProf for performance profiling on AMD processors may be affected, especially in sectors relying on AMD hardware for development or performance analysis. Mitigations include restricting local access to AMD μProf, applying vendor patches when available, and monitoring for abnormal application behavior. Countries with significant AMD hardware adoption and strong tech sectors, such as Germany, France, and the UK, are more likely to be impacted. Overall, this vulnerability poses a moderate risk primarily through denial of service scenarios in local environments.
CVE-2025-48511 is a medium severity vulnerability in AMD μProf caused by improper validation of input indices or offsets. It allows a local attacker with limited privileges to write to arbitrary physical memory addresses, potentially causing system crashes or denial of service. The vulnerability does not affect confidentiality or integrity directly and requires local access without user interaction. No known exploits are currently reported in the wild. The vulnerability impacts AMD μProf, a performance profiling tool used primarily by developers and system administrators. European organizations using AMD processors and AMD μProf for performance analysis may face operational disruptions if exploited. Mitigation involves restricting local access to trusted users and monitoring for abnormal system behavior, as no patches are currently available. Countries with significant AMD hardware adoption and strong technology sectors, such as Germany, France, and the UK, are most likely to be affected. The vulnerability’s medium severity reflects its limited scope and the requirement for local privileges but highlights the risk of denial of service in critical environments.
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability.
Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a Use-After-Free condition potentially resulting in loss of confidentiality or availability
Insufficient validation within Xilinx Run Time framework could allow a local attacker to escalate privileges from user space to kernel space, potentially compromising confidentiality, integrity, and/or availability.
CVE-2025-0005 is a high-severity integer overflow vulnerability in the AMD Xilinx Run Time (XRT) XOCL driver. It arises from improper input validation that allows a local attacker to trigger an integer overflow or wraparound. Exploitation can lead to application crashes or denial of service, impacting system availability. The vulnerability requires local access with no privileges or user interaction needed. While no known exploits are currently in the wild, the CVSS score of 7.3 indicates a significant risk. European organizations using AMD Xilinx hardware and XRT software stacks are at risk, especially those in sectors relying on FPGA acceleration. Mitigations include applying vendor patches once available, restricting local access to trusted users, and monitoring for anomalous system behavior. Countries with strong semiconductor and industrial sectors, such as Germany and France, are more likely to be affected. The vulnerability’s impact on availability and ease of exploitation without privileges justifies its high severity rating.
CVE-2025-52539 is a high-severity stack-based buffer overflow vulnerability in AMD's Xilinx Run Time (XRT) environment. It allows a local attacker to read or corrupt data via the advanced extensible interface (AXI), potentially impacting confidentiality, integrity, and availability. The vulnerability requires local access but no privileges or user interaction. Exploitation could lead to data leakage or system disruption. No known exploits are currently reported in the wild. European organizations using XRT in FPGA or hardware acceleration deployments are at risk. Mitigation involves applying vendor patches once available and restricting local access to trusted users. Countries with significant industrial, telecommunications, and research sectors using Xilinx products are more likely to be affected. The CVSS score is 7.3, indicating a high severity threat.
The Secure Flag passed to Versal™ Adaptive SoC’s Trusted Firmware for Cortex®-A processors (TF-A) for Arm’s Power State Coordination Interface (PSCI) commands were incorrectly set to secure instead of using the processor’s actual security state. This would allow the PSCI requests to appear they were from processors in the secure state instead of the non-secure state.
The security state of the calling processor into Trusted Firmware (TF-A) is not used and could potentially allow non-secure processors access to secure memories, access to crypto operations, and the ability to turn on and off subsystems within the SOC.
Incorrect default permissions in AMD StoreMI™ could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.
A DLL hijacking vulnerability in AMD StoreMI™ could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.
CVE-2025-62626 is a vulnerability in AMD Ryzen™ 9000HX Series Processors where improper handling of insufficient entropy in the True Random Number Generator (TRNG) can allow a local attacker to influence the values returned by the RDSEED instruction. This may lead to the use of insufficiently random values in cryptographic operations or other security-sensitive processes.
A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data integrity.
Improper access control within AMD SEV-SNP could allow an admin privileged attacker to write to the RMP during SNP initialization, potentially resulting in a loss of SEV-SNP guest memory integrity.
In AMD Zynq UltraScale+ devices, the lack of address validation when executing CSU runtime services through the PMU Firmware can allow access to isolated or protected memory spaces resulting in the loss of integrity and confidentiality.
