PT-2025-25828

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue was related to the debugfs summary output accessing uninitialized elements in the freq in and signal out arrays, causing...

IceWarp Mail Server Cross-Site Script Vulnerability

IceWarp Mail Server is a mail server product from the Czech company IceWarp IceWarp. The product supports email archiving, SmartAttach attachments, automatic migration and more. A cross-site scripting vulnerability exists in IceWarp Mail Server, which stems from the application's lack of effectiv...

TOTOLINK A3002RU and TOTOLINK A3002R have security vulnerabilities

The TOTOLINK A3002R and A3002RU are routers from TOTOLINK that support a wide range of network features and services. The TOTOLINK A3002R and A3002RU suffer from a buffer overflow vulnerability that stems from improper handling of the file /boafrm/formIpQoS in the HTTP POST request handler. No...

CVE-2025-47287

Tornado is a Python web framework and asynchronous networking library. When Tornado's multipart/form-data parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs,...

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Apache CXF (CVE-2025-23184)

Summary A vulnerability in Apache CXF that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-23184 DESCRIPTION: A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the...

CVE-2023-7197

The Marketing Twitter Bot WordPress plugin, in versions 1.11 and earlier , is susceptible to a vulnerability where a lack of CSRF checks , combined with missing sanitization and escaping, allows attackers to force logged-in administrators to add Stored XSS payloads via a CSRF attack . To mitigate...

CVE-2023-7168

The Better Follow Button for Jetpack WordPress plugin (versions through 8.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings. This flaw allows high-privilege users, such as administrators, to perform XSS attacks,...

CVE-2023-6783

The WolfNet IDX for WordPress plugin (versions 1.19.1 and earlier ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw arises because the plugin fails to properly sanitise and escape certain settings, allowing high-privilege users, such as administrators, to perform XSS attacks....

CVE-2025-47786

CVE-2025-47786 affects Emlog 2.5.13. The vulnerability is a stored cross-site scripting issue in /admin/comment.php where the unvalidated parameter perpage_num is stored in the database (admin_commend_perpage_num) and the output is not filtered, allowing a registered user to inject JavaScript tha...

CVE-2025-47774

creationtimestamp| type| source ---|---|--- 2025-05-15 19:02:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7ba277n2p...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Exploit for CVE-2025-4190

CVE-2025-4190 — WordPress CSV Mass Importer ≤ 1.2 Arbitrary Fi...

CVE-2025-4695

creationtimestamp| type| source ---|---|--- 2025-05-15 12:34:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16465 2025-05-15 15:03:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp7rvhya4d2w...

CVE-2025-26390

creationtimestamp| type| source ---|---|--- 2025-05-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-135-10...

CVE-2025-4591

creationtimestamp| type| source ---|---|--- 2025-05-15 06:57:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp6wrgupt52p...

CVE-2024-48766

NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. This is related to components/logs.php...

PT-2025-21568 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: Horilla versions prior to 1.3 Description: Horilla is a free and open source Human Resource Management System HRMS. In affected versions, an attacker can manipulate a Horilla URL to refer to an external domain. Upon clicking and logging in, t...

RHEL 8 : kernel (RHSA-2025:7682)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:7682 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: netfilter: ipset: add missing...

CVE-2015-5386

creationtimestamp| type| source ---|---|--- 2025-05-14 23:15:09+00:00| seen| https://gist.github.com/0xi1y4an7/605ea54aa36cbd993d66a4e7d1674901...

WordPress EG-Series plugin <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by muhammad yudha in WordPress Plugin EG-Series versions = 2.1.1...