CVE-2025-64347

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

Malicious Package

Overview Sharp7Extend is a malicious package. This package contains malicious code that injects time-delayed destructive payloads into database operations and target industrial control systems. Published under the NuGet alias shanhai666 together with 8 other malicious packages between 2023 and...

SourceCodester Pet Grooming Management Software 安全漏洞

SourceCodester Pet Grooming Management Software is an open source pet grooming management system from SourceCodester. A security vulnerability exists in SourceCodester Pet Grooming Management Software version 1.0, which stems from not implementing sufficient anti-CSRF tokens or same-site cookie...

Lexmark Printers Race Condition (CVE-2020-35546)

A race condition exists while processing the state of the two security jumpers in an MX6500e. This can cause occasional misreads of the security jumper state during boot, causing the device to incorrectly believe the security jumper state has changed. The result is that security access controls m...

CVE-2025-64173

Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access...

Take control of your privacy with updates on Malwarebytes for Windows

It’s getting harder to keep your Windows space truly yours, as Microsoft increasingly serves annoying ads and tracks your data across third-party apps. Pushing back against your eroding privacy has been a scattered and sometimes complicated process… but we're making it easier for you. With the...

HTTP Request Smuggling

Http4s is vulnerable to HTTP Request Smuggling. The vulnerability is due to improper handling of the HTTP trailer section, which allows an attacker—when the app is deployed behind a reverse proxy that forwards trailer headers—to bypass front-end security controls, target active users, and poison...

[SECURITY] Fedora 42 Update: qt5-qtquickcontrols2-5.15.18-1.fc42

The Qt Labs Controls module provides a set of controls that can be used to build complete interfaces in Qt Quick. Unlike Qt Quick Controls, these controls are optimized for embedded systems and so are preferred for hardware with limited resources...

[SECURITY] Fedora 42 Update: qt5-qtquickcontrols-5.15.18-1.fc42

The Qt Quick Controls module provides a set of controls that can be used to build complete interfaces in Qt Quick...

WordPress plugin Effect Maker 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-45218

Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sertifier Certificate & Badge Maker: from n/a through = 1.21...

Fedora: Security Advisory (FEDORA-2025-976ccd79ae)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-62720

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users in the system, including private links that should only be accessible to their owners. The HTML and CSV export functions in the...

Securing the Open Android Ecosystem with Samsung Knox

Raise your hand if you've heard the myth, "Android isn't secure." Android phones, such as the Samsung Galaxy, unlock new ways of working. But, as an IT admin, you may worry about the security—after all, work data is critical. However, outdated concerns can hold your business back from unlocking i...

Improper Authorization

Overview doris-mcp-server is an Enterprise-grade Model Context Protocol MCP server implementation for Apache Doris Affected versions of this package are vulnerable to Improper Authorization via improper enforcement of access controls for SQL queries. An attacker can perform unauthorized...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989243 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in...

WordPress Essential Addons for Elementor plugin Authorization Missing Vulnerability

WordPress Essential Addons for Elementor plugin is an extension plugin designed for Elementor page builder, offering over 80 advanced widgets and modules for creating professional web designs. The WordPress Essential Addons for Elementor plugin suffers from an Authorization Missing vulnerability...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990086 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in...

CVE-2025-57130

ZwiiCMS up to v13.6.07 suffers an Incorrect Access Control flaw in the user management component that lets a remote, authenticated, low-privilege user escalate privileges by sending a specially crafted HTTP request to access/modify other users’ profiles (including admins). Documents consistently ...

What Is Attack Surface Mapping And Why It’s Critical To your Security Program

You might think an attack surface mapper is just another name for a vulnerability scanner, but they serve two very different purposes. A scanner tests the assets you already know about for specific weaknesses. An attack surface mapper answers a more fundamental question: What assets do I even hav...