CVE-2025-44899

creationtimestamp| type| source ---|---|--- 2025-05-06 22:26:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojwimxaun2h 2025-05-07 00:31:29+00:00| seen| https://t.me/cvedetector/24652 2025-05-07 21:15:52+00:00| seen|...

CVE-2025-47419

creationtimestamp| type| source ---|---|--- 2025-05-06 21:21:41+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15231 2025-05-06 21:25:13+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114462996084887280 2025-05-06 22:26:57+00:00| seen|...

WordPress Frontend Dashboard plugin 1.0-2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation

Missing Authorization to Unauthenticated Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin Frontend Dashboard versions 1.0-2.2.6...

WordPress WZ Followed Posts plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by muhammad yudha in WordPress Plugin WZ Followed Posts - Display what visitors are reading versions = 3.1.0...

GHSA-4VGF-2CM4-MP7C

creationtimestamp| type| source ---|---|--- 2025-05-06 20:21:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15218...

CVE-2025-46572 passport-wsfed-saml2 Has SAML Authentication Bypass via Signature Wrapping

passport-wsfed-saml2 provides passport strategy for both WS-fed and SAML2 protocol. A vulnerability present starting in version 3.0.5 up to and including version 4.6.3 allows an attacker to impersonate any user during SAML authentication by crafting a SAMLResponse. This can be done by using a val...

CVE-2025-46572

Summary of CVE-2025-46572 (passport-wsfed-saml2): A SAML-based impersonation vulnerability affects versions 3.0.5 through 4.6.3 of passport-wsfed-saml2 when the Service Provider uses this module and a valid SAML document signed by the IdP can be obtained. An attacker can craft a SAMLResponse to i...

CVE-2025-47256

Libxmp through 4.6.2 has a stack-based buffer overflow in depackpha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file...

CVE-2025-46820

creationtimestamp| type| source ---|---|--- 2025-05-06 19:19:58+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lojlqi2tlzb2 2025-05-06 19:21:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15197 2025-05-06...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities

Summary There are vulnerabilities in Open-Source Software OSS components consumed by IBM Cognos Dashboards on Cloud Pak for Data. Please refer to the Related Information section below for vulnerability impact. This Security Bulletin relates only to the direct usage of third-party components by IB...

CVE-2025-46816 goshs route not protected, allows command execution

goshs is a SimpleHTTPServer written in Go. Starting in version 0.3.4 and prior to version 1.0.5, running goshs without arguments makes it possible for anyone to execute commands on the server. The function dispatchReadPump does not checks the option cli -c, thus allowing anyone to execute arbitra...

CVE-2025-32022

creationtimestamp| type| source ---|---|--- 2025-05-06 18:21:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15183 2025-05-06 18:21:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojis7aepd2p 2025-05-06 19:20:03+00:00| seen|...

CVE-2025-37730

CVE-2025-37730 concerns improper certificate validation in Logstash’s TCP output, enabling MitM in “client” mode due to hostname verification not occurring when ssl_verification_mode is set to full. Affected component is the Logstash TCP output plugin (logstash-output-tcp). The root cause is lack...

CVE-2025-46736

creationtimestamp| type| source ---|---|--- 2025-05-06 17:21:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15163 2025-05-06 18:21:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojis7nmx22j 2025-05-06 19:20:02+00:00| seen|...

CVE-2025-46735

Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Provider before version 1.0.5. The windnsrecord resource did not sanitize the input variables. This could lead to authenticated command...

CVE-2025-32022

Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts of the heap, possibly causing random instabilities and undefined behavior. The urandom plugin is enabled by default, so this bug affects...

CVE-2025-22476

Dell Storage Center - Dell Storage Manager, versions 20.1.20, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote executi...

CVE-2025-22479

creationtimestamp| type| source ---|---|--- 2025-05-06 16:21:44+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15147 2025-05-06 18:21:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojis7kdma2h...

CVE-2025-4373

GLib (glib2.0) is affected by CVE-2025-4373 due to an integer overflow in g_string_insert_unichar() when inserting at a large position, causing a buffer underwrite. The issue affects GLib’s string utilities (g_string_insert_unichar) and is discussed across multiple advisories; Debian LTS fixes GL...

CVE-2025-4373 Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar

A flaw was found in GLib, which is vulnerable to an integer overflow in the gstringinsertunichar function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite...