The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan.

The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.

patch: do_ed_script in pch.c does not block strings beginning with a ! character

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.

The wp-ultimate-exporter plugin before 1.4.2 for WordPress has CSRF.

The wp-ultimate-csv-importer plugin before 5.6.1 for WordPress has CSRF.

The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.

The ultimate-member plugin before 2.0.4 for WordPress has XSS.

The contact-form-to-email plugin before 1.2.66 for WordPress has CSRF.

The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.

kernel: double free vulnerability in function f_midi_set_alt in drivers/usb/gadget/function/f_midi.c causing denial of service

In the Linux kernel before 4.16.4, a double free vulnerability in the f_midi_set_alt function of drivers/usb/gadget/function/f_midi.c in the f_midi driver may allow attackers to cause a denial of service or possibly have unspecified other impact.

Nespresso Prodigio devices lack Bluetooth connection security.

Jura E8 devices lack Bluetooth connection security.

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 relies on Key1 and SerialNo for unlock operations; however, these are derived from the MAC address, which is broadcasted by the device.

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.

Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31.

Swann SWWHD-INTCAM-HD devices have the twipc root password, leading to FTP access as root. NOTE: all affected customers were migrated by 2020-08-31.

The "Security and Privacy" Encryption feature in Mailpile before 1.0.0rc4 does not exclude disabled, revoked, and expired keys.

cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).

cPanel before 68.0.27 creates world-readable files during use of WHM Apache Includes Editor (SEC-388).