CVE-2025-15055 SlimStat Analytics <= 5.3.4 - Unauthenticated Stored Cross-Site Scripting via 'notes/resource' Parameters

The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' and 'resource' parameters in all versions up to, and including, 5.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress The Events Calendar plugin <= 6.15.12.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin The Events Calendar versions = 6.15.12.2...

CVE-2026-22687

creationtimestamp| type| source ---|---|--- 2026-01-09 03:18:25+00:00| published-proof-of-concept| https://github.com/Tencent/WeKnora/security/advisories/GHSA-pcwc-3fw3-8cqv 2026-01-10 05:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mc2a57uov52p 2026-01-10...

CVE-2025-67724

creationtimestamp| type| source ---|---|--- 2026-01-09 00:58:10+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3mbxc4hgw5h2p 2026-01-09 01:04:57+00:00| seen| https://bsky.app/profile/Ubuntu.activitypub.awakari.com.ap.brid.gy/post/3mbxc6dfkbdb2 2026-01-09 09:30:09+00:00| seen|...

Multi-Regional Cloud Honeypot Dataset (MURHCAD)

This data article introduces a comprehensive, high-resolution honeynet dataset designed to support standalone analyses of global cyberattack behaviors. Collected over a continuous 72-hour window June 9 to 11, 2025 on Microsoft Azure, the dataset comprises 132,425 individual attack events captured...

CVE-2025-68719

creationtimestamp| type| source ---|---|--- 2026-01-08 22:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwy7mh4al2b 2026-01-08 22:01:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbwyb4ephd2a 2026-01-08 23:59:35+00:00| seen|...

CVE-2025-68151

creationtimestamp| type| source ---|---|--- 2026-01-08 17:15:19+00:00| seen| Telegram/GM-svWPekxp6fZc4gMlOvYkGHuylr07tc7mBU4KKuEApJ4 2026-01-08 17:15:40+00:00| seen| Telegram/KVWOQnBiY3Eem9HhxjtYUT7TdVna0GpQEMRBO0Jx4tvF1fc...

CVE-2026-22246

Mastodon vulnerability (CVE-2026-22246): In 4.3, the severed-relationships notification feature allowed inspecting lost relationships, but the code that downloads lists of severed relationships did not verify the list owner. As a result, any registered local user could enumerate and access the se...

CVE-2025-69348

Missing Authorization vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar Countdown Addon: from n/a through = 1.4.15...

CVE-2025-69352

Missing Authorization vulnerability in StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through = 6.15.12.2...

kernel: Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue

A flaw was discovered in the Bluetooth subsystem of the Linux kernel. When processing a HCIEVNUMCOMPPKTS event, the function hciconntxdequeue did not properly hold or release the hdev device lock, which may lead to a use-after-free of the connection structure...

PT-2026-2182

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.3 through 4.3.16 Mastodon versions 4.4 through 4.4.10 Mastodon versions 4.5 through 4.5.3 Description Mastodon is a free, open-source social network server based on ActivityPub. A flaw exists in the code handling the downlo...

User Impersonation

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to User Impersonation via the Stripe Trigger node that does not verify incoming webhook requests against Stripe webhook signing secret. An attacker with valid webhook URL can execute unauthorized...

CVE-2025-4676

creationtimestamp| type| source ---|---|--- 2026-01-07 17:37:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbtz2cpkvn2u 2026-01-07 17:38:21+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbtz33d2kd2u 2026-01-07 18:06:41+00:00| seen|...

CVE-2025-66786

creationtimestamp| type| source ---|---|--- 2026-01-07 17:37:41+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbtyzuvu2y2p 2026-01-07 17:38:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbtz2mckw22z 2026-01-07 19:24:00+00:00| seen|...

CVE-2013-7480

The events-manager plugin before 5.3.6.1 for WordPress has XSS via the booking form and admin areas...

CVE-2013-7479

The events-manager plugin before 5.3.9 for WordPress has XSS in the search form field...

CVE-1999-0575

A Windows NT system's user audit policy does not log an event success or failure, e.g. for Logon and Logoff, File and Object Access, Use of User Rights, User and Group Management, Security Policy Changes, Restart, Shutdown, and System, and Process Tracking...

CVE-2019-16523

The events-manager plugin through 5.9.5 for WordPress aka Events Manager is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute mapstyle of shortcodes locationsmap and eventsmap provided by the plugin...

CVE-2019-12847

In JetBrains Hub versions earlier than 2018.4.11298, the audit events for SMTPSettings show a cleartext password to the admin user. It is only relevant in cases where a password has not changed since 2017, and if the audit log still contains events from before that period...