CVE-2025-57818 Firecrawl SSRF Vulnerability via malicious webhook

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery SSRF vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with...

CVE-2025-57818 Firecrawl SSRF Vulnerability via malicious webhook

Firecrawl turns entire websites into LLM-ready markdown or structured data. Prior to version 2.0.1, a server-side request forgery SSRF vulnerability was discovered in Firecrawl's webhook functionality. Authenticated users could configure a webhook to an internal URL and send POST requests with...

PT-2025-34801 · Firecrawl · Firecrawl

Name of the Vulnerable Software and Affected Versions: Firecrawl versions prior to 2.0.1 Description: Firecrawl is a tool that converts websites into LLM-ready markdown or structured data. A server-side request forgery SSRF vulnerability exists in the webhook functionality of Firecrawl...

Linux Distros Unpatched Vulnerability : CVE-2017-16805

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a denial of service invalid read and application crash via a crafted ELF file, related to...

PT-2025-34515 · WordPress · Ws Theme Addons

Name of the Vulnerable Software and Affected Versions: WS Theme Addons plugin for WordPress versions prior to 2.0.1 Description: The WS Theme Addons plugin for WordPress is susceptible to Stored Cross-Site Scripting through the ws weather shortcode. Insufficient input sanitization and output...

WordPress JobZilla - Job Board WordPress Theme Theme <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software JobZilla - Job Board WordPress Theme Type Theme Vulnerable versions = 2.0 Fixed in 2.0.1 OWASP Top 10 A5: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2025-49382 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID 33cb80ce3eab Credi...

Security Bulletin: IBM Cloud Transformation Advisor is affected by multiple vulnerabilities found in Java and Node.js (CVE-2025-48924, CVE-2025-4949)

Summary There are multiple vulnerabilities in Java and Node.js used by IBM Cloud Transformation Advisor. Vulnerability Details CVEID:CVE-2025-48924 DESCRIPTION: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with...

WordPress B Slider - Gutenberg Slider Block for WP plugin <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

WordPress B Slider - Gutenberg Slider Block for WP plugin = 2.0.0 - Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin B Slider versions = 2.0.0...

PT-2025-32637

Name of the Vulnerable Software and Affected Versions: Bouncy Castle for Java versions 1.0 through 1.77 Bouncy Castle for Java - FJA versions 1.0.0 through 2.0.0 Description: A resource allocation issue exists in Bouncy Castle for Java affecting all API modules. The vulnerability allows attackers...

CVE-2025-54885

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime defaulted t...

CVE-2025-54885 Thinbus generates insufficient entropy: 252 bits vs minimum 256 bits

Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol compliance bug causes the client to generate a fixed 252 bits of entropy instead of the intended bit length of the safe prime defaulted t...

Insufficient Entropy

Overview thinbus-srp is a Secure Remote Password SRP SRP6a implementation. Affected versions of this package are vulnerable to Insufficient Entropy in the toHex function. An attacker can reduce the security margin of the protocol and potentially compromise session confidentiality by exploiting th...

CVE-2025-7717 File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089

Missing Authorization vulnerability in Drupal File Download allows Forceful Browsing.This issue affects File Download: from 0.0.0 before 1.9.0, from 2.0.0 before 2.0.1...

Drupal Block Attributes 安全漏洞

Drupal Block Attributes is a configuration interface plugin for the Drupal community. A security vulnerability exists in Drupal Block Attributes versions prior to 1.1.0 and prior to 2.0.1, which stems from improper input neutralization during page generation and could lead to a cross-site scripti...

Drupal File Download 安全漏洞

Drupal File Download is a file download plugin for the Drupal community. A security vulnerability exists in Drupal File Download versions prior to 1.9.0 and prior to 2.0.1, which stems from a lack of authorization and could lead to a forced browsing attack...

PT-2025-30310 · Drupal · Drupal Block Attributes

Name of the Vulnerable Software and Affected Versions: Drupal Block Attributes versions 0.0.0 through 1.0.9 Drupal Block Attributes versions 2.0.0 through 2.0.0 Description: A flaw exists in Drupal Block Attributes that allows for Cross-Site Scripting XSS. This issue is due to improper...

CVE-2025-6673

The CVE covers the WordPress plugin Easy Restaurant Menu Manager. A Stored Cross-Site Scripting (XSS) flaw exists in the nsc_eprm_menu_link shortcode (versions up to 2.0.1) caused by insufficient input sanitization and output escaping of user-supplied attributes. This enables authenticated attack...

PT-2025-26544 · Ruoyi-Ai · Ruoyi-Ai

Name of the Vulnerable Software and Affected Versions: ageerle ruoyi-ai version 2.0.0 Description: A critical issue was found in the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulatio...

IBM Process Mining 输入验证错误漏洞

IBM Process Mining is a process mining solution from International Business Machines IBM. An input validation error vulnerability exists in IBM Process Mining versions 2.0.1 IF001 and 2.0.1, which stems from an open redirect and could lead to a phishing attack...

GHSA-G5HG-P3PH-G8QG Multer vulnerable to Denial of Service via unhandled exception

Impact A vulnerability in Multer versions =1.4.4-lts.1, 2.0.1 allows an attacker to trigger a Denial of Service DoS by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Patches Users should upgrade to 2.0...