CVE-2025-64122

CVE-2025-64122 describes an Insufficiently Protected Credentials vulnerability in the Nuvation Energy Multi-Stack Controller (MSC) that enables Signature Spoofing via Key Theft. Affected product: MSC versions up to and including 2.5.1. Root cause and impact are limited to credentials protection a...

CVE-2025-14627

CVE-2025-14627 affects the WP Import – Ultimate CSV XML Importer for WordPress plugin (up to version 7.35). Wordfence reports an SSRF vulnerability: Bitly shortlinks are unrevalidated after unshortening in upload_function(), allowing authenticated attackers with Contributor+ to force the server t...

CVE-2025-14627 WP Import – Ultimate CSV XML Importer for WordPress <= 7.35 - Authenticated (Contributor+) Server-Side Request Forgery via Bitly Shortlink Bypass

The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.35. This is due to inadequate validation of the resolved URL after following Bitly shortlink redirects in the uploadfunction method...

BIT-GITEA-2025-68945

In Gitea before 1.21.2, an anonymous user can visit a private user's project...

CVE-2025-14434

The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upkalexgridloadmoreposts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and...

PT-2026-8159

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak exists in the rocker module within the Linux kernel, specifically within the rocker world port post fini function. When ports are removed, memory allocated for rocker...

PT-2026-4668

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel related to a null pointer dereference within the ASoC ALSA on System-on-Chip subsystem, specifically in the tlv320adcx140 driver. The snd soc component...

PT-2026-20853

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.8 Description The application does not properly handle iframe content in the private area, allowing an attacker to inject and execute malicious scripts through iframe tags. The issue occurs because the application do...

PT-2026-20915

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9 Description SPIP versions before 4.4.9 contain a Cross-Site Scripting XSS issue in the private area. A previous fix in SPIP 4.4.8 was incomplete, and the echappe anti xss function was not consistently applied to...

PT-2026-4662

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the mlx5e netdev change profile function. A failure to attach a new profile during a profile change rollback can lead to a dangling netdev with a...

PT-2026-20914

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.4.9 Description SPIP versions prior to 4.4.9 contain a Stored Cross-Site Scripting XSS issue related to syndicated sites within the private area. The output from URL SYNDIC is not adequately sanitized when displaying...

In 2025, age checks started locking people out of the internet

If 2024 was the year lawmakers talked about online age verification, 2025 was the year they actually flipped the switch.​ In 2025, across parts of Europe and the US, age checks for certain websites especially pornography turned long‑running child‑protection debates into real‑world access controls...

CVE-2025-15389

CVE-2025-15389 affects QNO Technology VPN Firewall. The supplied connected docs confirm an OS Command Injection vulnerability that allows authenticated remote attackers to inject and execute arbitrary OS commands on the server. The issue is characterized with network-based access and high impact ...

CVE-2025-15388 QNO Technology｜VPN Firewall - OS Command Injection

VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-15387 QNO Technology｜VPN Firewall - Insufficient Entropy

VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user session through brute-force attacks and subsequently log into the system...

CVE-2025-15387

CVE-2025-15387 concerns QNO Technology’s VPN Firewall, where an Insufficient Entropy vulnerability allows unauthenticated remote attackers to obtain a logged-in user session via brute-forcing session identifiers and then log in. Root cause: insufficient entropy in session identifiers. Documented ...

EUVD-2025-205885

The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upkalexgridloadmoreposts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and...

CVE-2025-14434

The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upkalexgridloadmoreposts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and...

CVE-2025-14434 Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure

The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upkalexgridloadmoreposts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated attacker to query arbitrary posts and...

CVE-2025-14434

CVE-2025-14434 affects the WordPress plugin “Ultimate Post Kit Addons for Elementor” (versions prior to 4.0.16). The issue arises from multiple AJAX endpoints (e.g., loadmore posts) that do not verify whether targeted posts are published, enabling an unauthenticated attacker to query arbitrary po...