CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-4387

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcapaddtocartpopupuploadfiles function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with...

CVE-2025-44043

Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...

CVE-2024-44906

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...

CVE-2024-55567

CVE-2024-55567 affects InsydeH2O kernel (Insyde USB core) with a flaw in UsbCoreDxe that allows an SMM-level write of arbitrary memory due to improper input validation. Affected versions include InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.0...

CVE-2024-44906

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...

CVE-2025-49146

A connection handling flaw was found in the pgjdbc connection driver in configurations that require channel binding. Connections created with authentication methods that should not allow channel binding permit connections to use channel binding. This flaw allows attackers to position themselves i...

CVE-2024-4200

creationtimestamp| type| source ---|---|--- 2025-06-11 20:03:02+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lre7adyihk2p...

CVE-2025-32465

creationtimestamp| type| source ---|---|--- 2025-06-11 19:51:26+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114666470506828107 2025-06-11 20:16:15+00:00| seen| Telegram/d4nUwsOBOdQROW01SEnvlRo6E92wcWw7AWRntwHKYeAQB4 2025-06-11 23:14:01+00:00| seen|...

CVE-2025-40912

A denial-of-service vulnerability has been discovered in the CPAN CryptX module. This flaw can be triggered by an attacker who is able to supply specially malformed Unicode input. Such malicious input could lead to a program crash, impacting the availability of any applications or services that...

CVE-2025-32466

The CVE-2025-32466 issue affects RSMediaGallery! for Joomla, specifically versions 1.7.4 through 2.1.7. The dashboard component allows unsanitized user input to be stored and rendered, enabling SQL injection and the execution of injected JavaScript in a user’s browser when they interact with craf...

CVE-2025-25032

creationtimestamp| type| source ---|---|--- 2025-06-11 18:35:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18122 2025-06-11 20:16:15+00:00| seen| Telegram/d4nUwsOBOdQROW01SEnvlRo6E92wcWw7AWRntwHKYeAQB4 2025-06-11 21:33:14+00:00| seen|...

CVE-2025-40912

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362...

CVE-2025-49652

Missing Authentication in the registration feature of Lablup's BackendAI allows arbitrary users to create user accounts that can access private data even when registration is disabled...

CVE-2025-49150 Cursor Agent Potentially Leaks Information using JSON schema

Cursor is a code editor built for programming with AI. Prior to 0.51.0, by default, the setting json.schemaDownload.enable was set to True. This means that by writing a JSON file, an attacker can trigger an arbitrary HTTP GET request that does not require user confirmation. Since the Cursor Agent...

CVE-2025-40915

creationtimestamp| type| source ---|---|--- 2025-06-11 17:34:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18098 2025-06-11 20:16:04+00:00| published-proof-of-concept| Telegram/ph88y4G5oeScgD258CchMKrpr3BuS4k3KcSxkFOuLvPbbMI 2025-06-11 23:24:01+00:00| seen|...

CVE-2025-25032

IBM Cognos Analytics is affected by a memory-resource exhaustion denial-of-service vulnerability (CVE-2025-25032) impacting versions 11.2.0 through 12.0.4. An authenticated user can trigger a crafted request that exhausts memory, potentially impacting availability. Affected products/versions incl...

CVE-2025-4673

Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information...

CVE-2025-22874

Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon...

CVE-2025-40915 Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens

Mojolicious::Plugin::CSRF 1.03 for Perl uses a weak random number source for generating CSRF tokens. That version of the module generates tokens as an MD5 of the process id, the current time, and a single call to the built-in rand function...