Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

Multiple suspected Russia-linked threat actors are "aggressively" targeting individuals and organizations with ties to Ukraine and human rights with an aim to gain unauthorized access to Microsoft 365 accounts since early March 2025. The highly targeted social engineering operations, per Volexity...

Meon Bidding 安全漏洞

Meon Bidding is a bidding related solution from Meon India. Meon Bidding has a security vulnerability that stems from improper authorization controls on certain API endpoints, which could lead to unauthorized access to other user accounts...

Whistleblower: DOGE Siphoned NLRB Case Data

A security architect with the National Labor Relations Board NLRB alleges that employees from Elon Musk 's Department of Government Efficiency DOGE transferred gigabytes of sensitive data from agency case files in early March, using short-lived accounts configured to leave few traces of network...

CVE-2025-28103

CVE-2025-28103 affects laskBlog v2.6.1. The root cause is incorrect access control, enabling attackers to arbitrarily delete user accounts via a crafted request. The CVE entry notes a medium severity (CVSS v3.1: 6.4; Network exposure, Low confidentiality/integrity impact, no availability impact)....

CVE-2025-28103

Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request...

FlaskBlog 安全漏洞

FlaskBlog is a simple blogging application built using Flask by Doğukan Ürker, an individual developer. A security vulnerability exists in FlaskBlog version 2.6.1, which stems from improper access control and could lead to arbitrary deletion of user accounts...

CVE-2025-30257

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...

CVE-2025-27929

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-26906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.3...

Google Blocked 5.1B Harmful Ads and Suspended 39.2M Advertiser Accounts in 2024

Google on Wednesday revealed that it suspended over 39.2 million advertiser accounts in 2024, with a majority of them identified and blocked by its systems before it could serve harmful ads to users. In all, the tech giant said it stopped 5.1 billion bad ads, restricted 9.1 billion ads, and block...

CVE-2025-30257

Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...

CVE-2025-27929

Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...

CVE-2025-26906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ren Ventura WP Delete User Accounts wp-delete-user-accounts allows DOM-Based XSS.This issue affects WP Delete User Accounts: from n/a through = 1.2.3...

CVE-2025-26906

CVE-2025-26906 affects the WordPress plugin WP Delete User Accounts (affected up to version 1.2.3). It enables DOM-based XSS due to improper neutralization during web page generation. Wordfence shows the vulnerability as patched; remediation is to update to the fixed release/version beyond 1.2.3.

WordPress plugin WP Delete User Accounts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

RHEL 7 : python-django-horizon (RHSA-2016:1269)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:1269 advisory. OpenStack Dashboard Horizon provides administrators and users with a graphical interface to access, provision, and automate cloud-based resources...

Incorrect Authorization

Overview github.com/mattermost/mattermost/server/channels/app is a private-cloud Slack alternative Affected versions of this package are vulnerable to Incorrect Authorization in that a user with the "Edit Other Users" permission set, but not broader high-level permissions, can modify the properti...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in that a user with the "Edit Other Users" permission set, but not broader high-level permissions, can modify the properties of admin accounts. Remediation Upgrade...

The vulnerability of the PowerScale OneFS operating system, related to deficiencies in authentication procedures, allows a perpetrator to gain access to user accounts.

The vulnerability of the PowerScale OneFS operating system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain access to the user account...

The vulnerability of the PowerScale OneFS operating system, related to the use of the default password, allows a hacker to gain access to the user account.

The vulnerability of the PowerScale OneFS operating system is related to the use of a default password. Exploiting this vulnerability could allow an attacker to gain access to the user account...