GHSA-6QJF-G333-PV38 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

Impact There is an arbitrary code execution vulnerability in the CsvEnumerator class of the job-iteration repository. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system where the application is running, potentially leading to unauthorized access, data...

Why AppSec and CloudSec Belong Together in the Age of AI

AI accelerates development— and risk shouldn't be a blocker to innovation. Bridging AppSec and CloudSec with shared context and workflows is key to keeping up...

CVE-2025-6514

creationtimestamp| type| source ---|---|--- 2025-07-09 14:30:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltjzp6d32j2y 2025-07-09 19:28:16+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltkke2mlwl2j 2025-07-09 19:30:45+00:00| seen|...

CVE-2025-7102

A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-42966 Insecure Deserialization vulnerability in SAP NetWeaver (XML Data Archiving Service)

SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confidentiality, integrity, and availability ...

CVE-2025-53185

creationtimestamp| type| source ---|---|--- 2025-07-07 07:41:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltebwmgksm2s...

CVE-2025-53170

Null pointer dereference vulnerability in the application exit cause module Impact: Successful exploitation of this vulnerability may affect function stability...

CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-52805

creationtimestamp| type| source ---|---|--- 2025-07-04 13:38:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt5ehosfut2a...

Bridging the Security Knowledge Gap: Introducing AI ExplAIn for Imperva Cloud WAF

The challenge of maintaining robust web application security often comes down to communication. Security teams frequently spend countless hours explaining WAF blocking decisions to application developers who may lack security expertise. This communication gap not only creates friction between tea...

CVE-2025-49005

creationtimestamp| type| source ---|---|--- 2025-07-03 23:12:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3u3a3mqo2a 2025-07-04 09:00:05+00:00| seen| https://bsky.app/profile/rss.y-u-e.workers.dev/post/3lt4uw734il2l 2025-07-04 17:14:04+00:00| seen|...

CVE-2025-6071

creationtimestamp| type| source ---|---|--- 2025-07-03 19:38:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3i4pxddn2p 2025-07-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-02 2025-08-06 13:54:19+00:00| seen|...

CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455 CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455

CVE-2025-27455 is linked to a clickjacking vulnerability in Endress+Hauser MEAC300-FNADE4 web interface (end-user frame embedding allowed). Connected sources confirm the affected product and vulnerability class but do not provide a confirmed patch/version fix; one PT-SEC source notes no available...

The vulnerability of the http-foundation component of the Symfony software development and web application management platform allows attackers to access confidential data.

The vulnerability of the http-foundation component of the Symfony software development and web application management platform is related to the use of open redirection. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

CVE-2025-53106

creationtimestamp| type| source ---|---|--- 2025-07-02 04:31:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lsxey3vfhe2z 2025-07-02 14:54:26+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114784211147922979 2025-07-02 17:16:10+00:00| seen|...

Elastic WAF: Reshaping Application Security for DevOps and Hybrid Environments

We recently discussed Imperva’s vision for the future of application security, where we also covered the Imperva Security Engine. This innovative application security framework is powering up the next generation of Imperva solutions, the first of which is Imperva Elastic WAF. This blog is the fir...

CVE-2024-46992

CVE-2024-46992 affects Electron versions 30.0.0-alpha.1 through 30.0.4, and 31.0.0-alpha.1 through 31.0.0-beta.1. The issue is an ASAR integrity bypass that applies only when embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled, and only if the app is launched from a writable...