CVE-2025-36001

creationtimestamp| type| source ---|---|--- 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-08-24 08:00:03+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/99432 2026-08-25 00:00:25+00:00| published-proof-of-concept|...

CVE-2025-38685 affecting package kernel for versions less than 5.15.200.1-1

CVE-2025-38685 affecting package kernel for versions less than 5.15.200.1-1. An upgraded version of the package is available that resolves this issue...

Moderate: Red Hat Security Advisory: AMQ Clients 2026.Q1

An update is now available for Red Hat AMQ Clients Red Hat Product Security has rated this update as having an impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Reference...

USN-8033-5 linux-gcp-5.15, linux-kvm, linux-oracle, linux-oracle-5.15 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Nios II architecture; - Sun Sparc architecture; - User-Mode Linux UML; - x86 architecture; - Block layer subsystem;...

CVE-2025-25468 vulnerabilities

Vulnerabilities for packages: ffmpeg...

Dify - User Enumeration via "Account not found" Message

A user enumeration vulnerability exists in langgenius/dify, where the login API leaks information about whether a user account exists or not. When an invalid/non-existent email is used during login, the API returns a distinct error message such as "accountnotfound" or "Account not found.", allowi...

Unauthenticated Arbitrary Plugin Upload in Alone Theme

The Alone – Charity Multipurpose Non-profit WordPress Theme theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the aloneimportpackinstallplugin function in all versions up to, and including, 7.8.3. id: CVE-2025-5394 info: name: Unauthenticated Arbitra...

CVE-2025-60876 vulnerabilities

Vulnerabilities for packages: busybox...

CVE-2025-63051

CVE-2025-63051 in the WordPress plugin REHub Framework (REHub Framework before 19.9.9.4) is a confirmed vulnerability: Exposure of Sensitive System Information to an Unauthorized Control Sphere. Impact is described as exposure of embedded sensitive data; CVSS 3.1 base 4.3 (Medium) with network at...

CVE-2025-49364

creationtimestamp| type| source ---|---|--- 2026-01-20 20:20:26+00:00| seen| Telegram/1IBgnOZc6IZL3Sh55Cbs9jWVilwWcR2TFLiK1M4xFaXNo...

Security update for libsoup

This update for libsoup fixes the following issues: CVE-2025-14523: Reject duplicated Host in headers bsc1254876. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed fo...

WordPress twinklesmtp - Email Service Provider For WordPress plugin <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings vulnerability

WordPress twinklesmtp - Email Service Provider For WordPress plugin = 1.03 - Authenticated Administrator+ Stored Cross-Site Scripting via Sender Settings vulnerability discovered by Bhumividh Treloges in WordPress Plugin twinklesmtp versions = 1.03...

CVE-2025-15252

A flaw has been found in Tenda M3 1.0.0.134903. The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation of the argument startip/endip/leasetime/gateway/dns1/dns2 causes stack-based buffer overflow. The attack can be initiated remotely. The...

CVE-2025-62990

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-beaver-builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a through = 3.9.2...

Huawei EulerOS: Security Advisory for ncurses (EulerOS-SA-2025-2554)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-64376

CVE-2025-64376 affects the WordPress ListingPro theme (and ListingPro listings) prior to version 2.9.10. The root cause is improper neutralization of input during web page generation, allowing Reflected XSS. The entry cites a CVSS v3.1 base score of 7.1 (HIGH) with network access, low attack comp...

CVE-2025-68293

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: fix NULL pointer deference when splitting folio Commit c010d47f107f "mm: thp: split huge page to any lower order pages" introduced an early check on the folio's order via mapping-flags before proceeding with the...

CVE-2025-13124 IDOR in Netiket''s ApplyLogic

Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers. This issue affects ApplyLogic: through 01.12.2025...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell Metasploit Module CVE-2025-55182 BETA A robus...

DEBIAN-CVE-2025-40344

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avsdaifeshutdown handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As the former frees the DAI's private context,...