8358 matches found
CVE-2024-10219
An issue has been discovered in GitLab CE/EE affecting all versions from 15.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that under certain conditions could have allowed authenticated users to bypass access controls and download private artifacts by accessing specific API endpoints...
Kap 代码注入漏洞
Kap is an open source screen recorder from Wulkano Open Source. A code injection vulnerability exists in Kap version 3.6.0, which stems from improper code generation control and could lead to a TCC bypass...
Malicious code in react-microphone-controls (npm)
The package react-microphone-controls was found to contain malicious code...
MAL-2025-31803 Malicious code in react-microphone-controls (npm)
The package react-microphone-controls was found to contain malicious code...
Malicious code in cmf.mes.business.controls (npm)
The package cmf.mes.business.controls was found to contain malicious code...
CVE-2025-54717
CVE-2025-54717 affects the WordPress WP Membership plugin (versions up to 1.6.3). It is a Missing Authorization flaw due to incorrectly configured access control security levels, enabling a settings change vulnerability. Remediation: upgrade WP Membership to a version later than 1.6.3 (per Patchs...
CVE-2025-55716
CVE-2025-55716 concerns the WordPress plugin WP Statistics (versions up to 14.15). The issue is described as a Missing Authorization vulnerability due to incorrectly configured access control levels, enabling unauthorized actions without user interaction. The CVSS 3.1 base metrics indicate a Netw...
AZL-66300 CVE-2025-8713 affecting package postgresql for versions less than 16.10-1
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
CVE-2025-8713 PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
Exposure of Sensitive Information Through Metadata
Overview Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata via optimizer statistics. An attacker can access sensitive sampled data by querying views, partitions, or child tables by crafting a leaky operator that bypasses view access control lis...
CVE-2025-8713 PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this...
CVE-2025-50031
Missing Authorization vulnerability in syedamirhussain91 DB Backup db-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DB Backup: from n/a through = 6.0...
IBM 2025 Cost of a Data Breach Report: Lessons for API and AI Security
IBM’s 2025 Cost of a Data Breach Report offers one of the clearest and most comprehensive views yet of how AI adoption is shaping the security landscape. While breach numbers are relatively low – only 13% of organizations reported breaches involving AI models or applications – the report reveals ...
CVE-2025-28962
CVE-2025-28962: WordPress/ plugin "Advanced Google Universal Analytics" (stefanoai) has a Missing Authorization vulnerability. The issue arises from misconfigured access control levels, enabling unauthorized access to potentially sensitive data. Affected software versions: Advanced Google Univers...
CVE-2025-52721 WordPress Global Gallery Plugin <= 9.2.3 - Broken Access Control Vulnerability
Missing Authorization vulnerability in LCweb Global Gallery allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Global Gallery: from n/a through 9.2.3...
PT-2025-33165 · WordPress · Wp Lead Capturing Pages
Name of the Vulnerable Software and Affected Versions: WP Lead Capturing Pages versions prior to 2.3 Description: A missing authorization issue exists in kamleshyadav WP Lead Capturing Pages due to incorrectly configured access control security levels. Recommendations: Update WP Lead Capturing...
Vulnerability in core server (CVE-2025-8713)
PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intende...
Data Brokers Face New Pressure for Hiding Opt-Out Pages From Google
After reporters found dozens of firms hiding privacy tools from search results, US senator Maggie Hassan insists the companies explain their practices—and pledge to improve access to privacy controls...
CVE-2024-10219
GitLab CVE-2024-10219 affects GitLab CE/EE versions 15.6–before 18.0.6, 18.1–before 18.1.4, and 18.2–before 18.2.2. The issue allows authenticated users to bypass access controls and download private artifacts by abusing certain API endpoints. Mitigation requires upgrading to the fixed releases: ...
