CVE-2025-7076

A vulnerability was found in BlackVue Dashcam 590X up to 20250624. It has been rated as critical. Affected by this issue is some unknown functionality of the file /upload.cgi of the component Configuration Handler. The manipulation leads to improper access controls. The attack needs to be initiat...

PT-2025-28041 · Blackvue · Blackvue Dashcam 590X

Name of the Vulnerable Software and Affected Versions: BlackVue Dashcam 590X up to 20250624 Description: A critical issue affects some unknown functionality of the file /upload.cgi of the component Configuration Handler, leading to improper access controls. The attack must be initiated within the...

PT-2025-28132

Name of the Vulnerable Software and Affected Versions: Redis versions prior to 8.0.3 Redis versions prior to 7.4.5 Redis versions prior to 7.2.10 Redis versions prior to 6.2.19 Description: The issue is related to an unauthenticated connection that can cause repeated IP protocol errors, leading t...

Your AI Agents Might Be Leaking Data — Watch this Webinar to Learn How to Stop It

Generative AI is changing how businesses work, learn, and innovate. But beneath the surface, something dangerous is happening. AI agents and custom GenAI workflows are creating new, hidden ways for sensitive enterprise data to leak —and most teams don’t even realize it. If you’re building,...

CVE-2025-34074

An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled...

⚡ Weekly Recap: Airline Hacks, Citrix 0-Day, Outlook Malware, Banking Trojans and more

Ever wonder what happens when attackers don’t break the rules—they just follow them better than we do? When systems work exactly as they’re built to, but that “by design” behavior quietly opens the door to risk? This week brings stories that make you stop and rethink what’s truly under control...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a lack of additional caching controls on the login page that preven...

CVE-2025-5526

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user...

CVE-2025-5526

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user...

CVE-2025-5526 BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user...

CVE-2025-5526

The BuddyPress Docs WordPress plugin (versions prior to 2.2.5 ) is vulnerable to an arbitrary document read and update flaw due to insufficient access controls . This allows a logged-in user with Subscriber+ privileges to view and download files belonging to other users. To remediate this issue, ...

CVE-2025-5526 BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update

The BuddyPress Docs WordPress plugin before 2.2.5 lacks proper access controls and allows a logged in user to view and download files belonging to another user...

PT-2025-27062 · WordPress · Buddypress Docs

Name of the Vulnerable Software and Affected Versions: BuddyPress Docs WordPress plugin version 2.2.4 and earlier Description: The issue is related to inadequate access controls in the BuddyPress Docs WordPress plugin, allowing a logged-in user to view and download files belonging to another user...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper enforcement of resource limits in the nftables rules generation process for managed bridge networks. An attacker can exhaust the DHCP pool and disrupt network...

WhatsApp Adds AI-Powered Message Summaries for Faster Chat Previews

Popular messaging platform WhatsApp has added a new artificial intelligence AI-powered feature that leverages its in-house solution Meta AI to summarize unread messages in chats. The feature, called Message Summaries, is currently rolling out in the English language to users in the United States,...

CVE-2025-6527

A vulnerability, which was classified as problematic, was found in 70mai M300 up to 20250611. Affected is an unknown function of the component Web Server. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The complexity of an attack is...

CVE-2025-6443

Mikrotik RouterOS VXLAN Source IP Improper Access Control Vulnerability. This vulnerability allows remote attackers to bypass access restrictions on affected installations of Mikrotik RouterOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

The vulnerabilities in the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B allow attackers to bypass security restrictions.

The vulnerabilities of the software platforms for developing and managing online stores such as Magento Open Source, Adobe Commerce, and Adobe Commerce B2B are related to deficiencies in authentication procedures. Exploiting these vulnerabilities can allow attackers to bypass security restriction...

CVE-2025-34039

CVE-2025-34039 affects Yonyou UFIDA NC v6.5 and earlier, due to exposure of the BeanShell testing servlet (bsh.servlet.BshServlet) without proper access controls. An unauthenticated remote attacker can exploit the bsh.script parameter to execute arbitrary Java code, potentially running system com...

CVE-2025-6532

A vulnerability classified as problematic was found in NOYAFA/Xiami LF9 Pro up to 20250611. Affected by this vulnerability is an unknown functionality of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. The attack can only be initiated within the...