CVE-2025-0939

CVE-2025-0939 concerns the WordPress plugin MagicForm (WordPress Form Builder) up to version 1.6.2, due to a missing capability check in its AJAX actions. According to Wordfence, authenticated attackers with Subscriber-level access or higher can invoke those AJAX actions to delete or view logs, a...

CVE-2025-24527

CVE-2025-24527 affects Akamai Enterprise Application Access (EAA) prior to 2025-01-17. The issue allows an administrator who knows another tenant’s 128‑bit connector GUID to execute debug commands on that connector. CVSSv3.1 base metrics: AV:N, AC:H, PR:H, UI:N, S:C, C:H, I:H, A:H (base score 8.0...

Debian dla-4034 : libsimgear-dev - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-4034 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4034-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-24108

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data...

CVE-2025-24116

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences...

CVE-2025-24108

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data...

CVE-2025-24096

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3. A malicious app may be able to access arbitrary files...

CVE-2025-24116

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to bypass Privacy preferences...

CVE-2025-24116

CVE-2025-24116 relates to an access issue in macOS where an app may bypass Privacy preferences. The issue was mitigated by adding sandbox restrictions and is fixed in macOS Ventura 13.7.3, macOS Sequoia 15.3, and macOS Sonoma 14.7.3. The available documents do not specify the exact vulnerable com...

CVE-2025-24116

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences...

CVE-2025-24108

CVE-2025-24108 affects macOS Sequoia 15.3 where an access issue could allow an app to access protected user data. The NVD description notes the issue was addressed with additional sandbox restrictions and that the fix is included in macOS Sequoia 15.3. Apple’s security content for Sequoia 15.3 co...

CVE-2024-54541

This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.7.2, visionOS 2.2, tvOS 18.2, watchOS 11.2, iOS 18.2 and iPadOS 18.2, macOS Sonoma 14.7.2, macOS Sequoia 15.2. An app may be able to access user-sensitive data...

BIT-ELK-2024-43707 Kibana exposure of sensitive information to an unauthorized actor

An issue was identified in Kibana where a user without access to Fleet can view Elastic Agent policies that could contain sensitive information. The nature of the sensitive information depends on the integrations enabled for the Elastic Agent and their respective versions...

CVE-2025-23222

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus servic...

CVE-2025-0637 Inadequate access control in Beta10

It has been found that the Beta10 software does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentication, to access private areas and/or areas intended for other roles. The vulnerability has been...

CVE-2024-43708

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted payload to a number of inputs in Kibana UI. This can be carried out by users with read access to any feature in Kibana...

chromium -- multiple security fixes

Chrome Releases reports: This update includes 3 security fixes: 386143468 High CVE-2025-0611: Object corruption in V8. Reported by 303f06e3 on 2024-12-26 385155406 High CVE-2025-0612: Out of bounds memory access in V8. Reported by Alan Goodman on 2024-12-20...

CVE-2023-40108

CVE-2023-40108 describes an information-disclosure vulnerability in Google Android where a lack of permission checking can allow access to media content belonging to other users without executing code or requiring user interaction. The CVE notes a local access vector with medium base score (5.5) ...

CVE-2024-57935

The CVE-ID describes a Linux kernel flaw in RDMA/hns: when destroying a QP, an invalid dip_ctx pointer could be accessed if the QP could not be modified to RTR, due to the dip_ctx not being attached. This is a local-attack surface with potential kernel access to cause a denial of service or crash...

CVE-2025-21650

In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclgefetchpfreg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses. However, hclgefetchpfreg does not...