CVE-2025-55296

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

Australian ISP iiNet Reports Data Breach, Customer Accounts Stolen

Australian ISP iiNet confirms data breach as hackers stole 280,000 email accounts, phone numbers and user data using…...

GHSA-VXQ6-8CWM-WJ99 LibreNMS allows stored XSS in Alert Template name field

Summary A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS alertdocument.cookie/script and filling the other fields with arbitrary content e.g., test, once the template is saved, the script is executed. This confirms that user input is stored and later rendered without proper outp...

CVE-2025-55296

librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting XSS vulnerability exists in LibreNMS = 25.6.0 in the Alert Template creation feature. This allows a user with the admin role to inject malicious JavaScript, which will be executed when the template...

CVE-2025-55299 VaulTLS has a password-based login exploit in additional user accounts

VaulTLS is a modern solution for managing mTLS mutual TLS certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the...

Linux Distros Unpatched Vulnerability : CVE-2021-44460

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with...

Linux Distros Unpatched Vulnerability : CVE-2017-14990

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress 4.8.2 stores cleartext wpsignups.activationkey values but stores the analogous wpusers.useractivationkey values as hashes, which might make it easier...

Linux Distros Unpatched Vulnerability : CVE-2020-5504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In phpMyAdmin 4 before 4.9.4 and 5 before 5.0.1, SQL injection exists in the user accounts page. A malicious user could inject custom SQL in place of their own...

WordPress plugin WPGYM - Wordpress Gym Management System 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. WordPress plugin WPGYM - Wordpress Gym Management System...

Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring...

Malicious code in accounts-react-components (npm)

The package accounts-react-components was found to contain malicious code...

MAL-2025-13981 Malicious code in accounts-react-components (npm)

The package accounts-react-components was found to contain malicious code...

Malicious code in accounts-fonts (npm)

The package accounts-fonts was found to contain malicious code...

MAL-2025-7939 Malicious code in @framgia/viblo-accounts-auth-web (npm)

The package @framgia/viblo-accounts-auth-web was found to contain malicious code...

MAL-2025-13980 Malicious code in accounts-fonts (npm)

The package accounts-fonts was found to contain malicious code...

Malicious code in @framgia/viblo-accounts-auth-web (npm)

The package @framgia/viblo-accounts-auth-web was found to contain malicious code...

SUSE CVE-2025-53942

authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...

Connex Credit Union Data Breach Affects 172,000 Members

Connex Credit Union breach exposes data of 172000 members, legal probe launched, experts urge victims to monitor accounts…...

CVE-2025-8310

Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password...

CVE-2025-8310

CVE-2025-8310 affects Ivanti Virtual Application Delivery Controller (vADC) prior to 22.9. The admin console lacks proper authorization, enabling a remote authenticated attacker to take over admin accounts by resetting passwords. The vulnerability is mitigated by updating to version 22.9 or later...