CVE-2025-54313

CVE-2025-54313 refers to eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 which contain embedded malicious code用于 supply-chain compromise. The description states that installing an affected package executes a malicious install.js that launches node-gyp.dll malware on Windows. Connected IB...

CVE-2025-7394

In the OpenSSL compatibility layer implementation, the function RANDpoll was not behaving as expected and leading to the potential for predictable values returned from RANDbytes after fork is called. This can lead to weak or predictable random numbers generated in applications that are both using...

CVE-2025-7814

creationtimestamp| type| source ---|---|--- 2025-07-18 22:45:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lubjl67gzw2b...

CVE-2025-7805

creationtimestamp| type| source ---|---|--- 2025-07-18 22:36:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lubj352aow2i 2025-07-22 03:54:24+00:00| seen| MISP/a3c5beab-b790-4171-8b4c-02c8a9678071 2025-09-09 11:53:42+00:00| seen| MISP/a3c5beab-b790-4171-8b4c-02c8a9678071...

CVE-2025-7395 Domain Name Validation Bypass with Apple Native Certificate Validation

A certificate verification error in wolfSSL when building with the WOLFSSLSYSCACERTS and WOLFSSLAPPLENATIVECERTVALIDATION options results in the wolfSSL client failing to properly verify the server certificate's domain name, allowing any certificate issued by a trusted CA to be accepted regardles...

CVE-2025-53901

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...

CVE-2025-54309

creationtimestamp| type| source ---|---|--- 2025-07-18 19:40:19+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lub77vulfd26 2025-07-18 19:52:43+00:00| seen| https://bsky.app/profile/rapid7.com/post/3lub7vy2f6s2k 2025-07-18 22:24:47+00:00| seen|...

CVE-2025-7795

creationtimestamp| type| source ---|---|--- 2025-07-18 19:10:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lub5lh4b3t2i 2025-07-19 21:00:04+00:00| published-proof-of-concept| Telegram/0jvjkPEZnoW0g8cjJAx2BIIU7bcv6ZLASQZj1TPT87LGFs 2025-07-20 07:00:11+00:00|...

CVE-2025-5992

creationtimestamp| type| source ---|---|--- 2025-07-18 17:52:32+00:00| seen| https://gist.github.com/EbonJaeger/99013e0308373f7313be77f71320c51b...

CVE-2025-53945 apko has incorrect permission (0666) in /etc/ld.so.cache and other files

apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files were inadvertently set to 0666, which could likely be abused for root escalation. Version 0.29.5 contains a fix for the issue...

CVE-2025-49486

creationtimestamp| type| source ---|---|--- 2025-07-18 12:44:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3luahxpluzu2h...

CVE-2025-6233

creationtimestamp| type| source ---|---|--- 2025-07-18 12:29:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3luah4u4gsk27...

CVE-2025-53997

Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through = 4.0.4...

CVE-2025-6726

creationtimestamp| type| source ---|---|--- 2025-07-18 09:19:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lua4kj2xal2i...

CVE-2025-3740

creationtimestamp| type| source ---|---|--- 2025-07-18 06:35:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lu7tev2xxm2j 2025-08-11 22:05:38+00:00| published-proof-of-concept| https://t.me/captainsmok3rofficial/68...

WordPress aapanel WP Toolkit plugin 1.0 - 1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via auto_login() Function vulnerability

WordPress aapanel WP Toolkit plugin 1.0 - 1.1 - Missing Authorization to Authenticated Subscriber+ Privilege Escalation via autologin Function vulnerability discovered by kr0d in WordPress Plugin aapanel WP Toolkit versions 1.0 - 1.1...

CVE-2025-7756

creationtimestamp| type| source ---|---|--- 2025-07-18 01:00:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lu7anyok7c2w...

CVE-2025-54309

CrushFTP 10 before 10.8.5 and 11 before 11.3.423, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote attackers to obtain admin access via HTTPS, as exploited in the wild in July 2025...

CVE-2025-49840

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in inferencewebui.py. The GPTdropdown variable takes user input and passes it to the changegptweights function. In changegptweights, the user input,...

CVE-2025-49839

GPT-SoVITS-WebUI is a voice conversion and text-to-speech webUI. In versions 20250228v3 and prior, there is an unsafe deserialization vulnerability in bsroformer.py. The modelchoose variable takes user input e.g. a path to a model and passes it to the uvr function. In uvr, a new instance of...