NETGEAR JWNR2000 injection vulnerability

The NETGEAR JWNR2000v2 is a wireless router from NETGEAR. The NETGEAR JWNR2000v2 suffers from a command injection vulnerability that stems from the cmdwireless function parameter host failing to properly filter constructor command special characters, commands, and so on. No details of the...

Fedora: Security Advisory (FEDORA-2025-bca38111fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required...

WordPress tagDiv Opt-In Builder plugin <= 1.7 - Authenticated (Subscriber+) SQL Injection via subscriptionCouponId Parameter vulnerability

Authenticated Subscriber+ SQL Injection via subscriptionCouponId Parameter vulnerability discovered by Truoc Phan in WordPress Plugin tagDiv Opt-In Builder versions = 1.7...

WordPress Seraphinite Accelerator plugin <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions vulnerability

Cross-Site Request Forgery to Multiple Administrative Actions vulnerability discovered by Nabil Irawan in WordPress Plugin Seraphinite Accelerator versions = 2.27.21...

CVE-2025-4086

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for...

CVE-2025-0716

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/ContentSpoofing and also negatively affect...

CVE-2025-4071

A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /test-details.php. The manipulation of the argument Status leads to sql injection. The attack can be initiated remotely. The exploit h...

CVE-2025-4093

Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort this could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox ESR 128.10 and Thunderbird 128.10...

CVE-2025-3929

creationtimestamp| type| source ---|---|--- 2025-04-29 12:12:30+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13800 2025-04-29 15:09:20+00:00| seen| https://t.me/cvedetector/23988 2025-05-08 21:02:21+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3loosp5phek2r...

WordPress Calculated Fields Form plugin < 5.2.62 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Calculated Fields Form versions 5.2.62...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is vulnerable to server-side request forgery (CVE-2025-27907)

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is vulnerable to server-side request forgery. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions ---|---...

CISA Adds Actively Exploited Broadcom and Commvault Flaws to KEV Database

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added two high-severity security flaws impacting Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The vulnerabilities...

CVE-2025-46755

creationtimestamp| type| source ---|---|--- 2025-04-29 03:50:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnweufufvu2r 2025-04-29 06:47:38+00:00| seen| https://t.me/cvedetector/23961...

PT-2025-18227 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A rejected reason is mentioned, but no specific details about the issue are provided. No information is available about potentially affected devices or real-world incidents. Recommendations:...

PT-2025-18217

Name of the Vulnerable Software and Affected Versions vLLM versions 0.8.0 through 0.8.4 Description The issue concerns a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. It is caused by inefficient list concatenation operations, resulting in quadrat...

PHPGurukul COVID19 Testing Management System has a security vulnerability

The COVID19 Testing Management System is a new crown pneumonia testing management system. The COVID19 Testing Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Status in the /test-details.php...

CVE-2025-34491

creationtimestamp| type| source ---|---|--- 2025-04-28 20:11:21+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13733 2025-04-28 21:49:17+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114417790264877305 2025-04-28 22:25:29+00:00| seen|...

CVE-2025-4023

creationtimestamp| type| source ---|---|--- 2025-04-28 14:10:46+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13679 2025-04-28 17:24:24+00:00| seen| https://t.me/cvedetector/23908 2025-04-28 17:45:21+00:00| seen|...

Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Jinja is an extensible templating engine. Jinja sandboxed environment interacts with the attr filter allows an attacker to attack.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Service Component uses Jinja is an extensible templating engine. Jinja sandboxed environment interacts with the attr filter allows an attacker to attack.This bulletin contains information regarding the vulnerability and its fixture...