Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
No package-associated file paths were observed for the displayed build metadata.
Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data.
This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through
Medium(6.9)
AffectedDetails (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Affected
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Affected
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for bot
High(8.1)
CISA KEV
AffectedDetails (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through
High(7.1)
AffectedDetails (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher.
Prerequisites:
* Imagick and Ghostscript in use on the server
High(8.8)
Unknown
Matching against OpenFactory catalog package versions is in progress. Observed:
Details (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 6.8.10+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen.
Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be esc
High(8.9)
Unknown
Matching against OpenFactory catalog package versions is in progress. Observed:
Details (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.8.7+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Affected · Fixed: 6.8.7+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pas
Critical(9.1)
CISA KEV
Unknown
Matching against OpenFactory catalog package versions is in progress. Observed:
Details (4)
6.8.10+dfsg1-0+deb13u1 · all · trixie-security
Fixed · Fixed: 6.8.6+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.6+dfsg1-0+deb13u1 · all · trixie-security · Historical version
Fixed · Fixed: 6.8.6+dfsg1-0+deb13u1
nvd · wordpress · debian · 13
6.8.7+dfsg1-0+deb13u1 · all · trixie-security · Historical version
