WordPress WP Compress plugin <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by mikemyers in WordPress Plugin WP Compress versions = 6.30.15...

Medium: python

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

GHSA-VGMH-MQM4-8J88 pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could...

pared Vulnerable to Use After Free in `Parc` and `Prc` Due to Missing Lifetime Constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could...

Cisco IOS XR Data Forgery Issue Vulnerability

Cisco IOS XR is a set of operating systems developed by the American company Cisco Cisco for its network equipment. Cisco IOS XR suffers from a data forgery vulnerability that stems from insufficient module validation during software loading, which could be exploited by an attacker to launch...

CVE-2025-30107

On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery...

Insufficient Isolation of System-Dependent Functions

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insufficient Isolation of System-Dependent Functions due to improper access control on the /api/v1/prompts/ and /api/v1/prompts/command/commandid interfaces. An attacker can view and retrieve prompt informati...

GHSA-53GH-P8JC-7RG8 LiteLLM Vulnerable to Remote Code Execution (RCE)

BerriAI/litellm version 1.40.12 contains a vulnerability that allows remote code execution. The issue exists in the handling of the 'postcallrules' configuration, where a callback function can be added. The provided value is split at the final '.' mark, with the last part considered the function...

Cryptominers’ Anatomy: Analyzing Cryptominers

...

WordPress FoodBakery plugin <= 4.7 - Cross-Site Request Forgery in Multiple Functions vulnerability

Cross-Site Request Forgery in Multiple Functions vulnerability discovered by Lucio Sá in WordPress Plugin FoodBakery versions = 4.7...

WordPress FoodBakery plugin <= 4.7 - Missing Authorization in Multiple Functions vulnerability

Missing Authorization in Multiple Functions vulnerability discovered by Lucio Sá in WordPress Plugin FoodBakery versions = 4.7...

CVE-2025-2199

CVE-2025-2199 describes an SQL injection vulnerability in the Innovación y Cualificación local administration plugin ajax.php. The flaw allows an attacker to inject SQL via multiple parameters (searchActionsToUpdate, searchSpecialitiesPending, searchSpecialitiesLinked, searchUsersToUpdateProfile,...

CVE-2025-30143

Rule 3000216 before version 2 in Akamai App & API Protector with Akamai ASE before 2024-12-10 does not properly consider JavaScript variable assignment to built-in functions and properties...

Allocation of Resources Without Limits or Throttling

Overview gmpy2 is a gmpy2 interface to GMP, MPFR, and MPC for Python 3.7+ Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when performing arbitrary-precision calculations based on the GNU Multiple Precision Arithmetic Library GMP, in...

RUSTSEC-2025-0016 Use after free in `Parc` and `Prc` due to missing lifetime constraints

Affected versions of this crate didn't provide sufficient lifetime constraints to conversion functions from alloc::sync::Arc and alloc::rc::Rc, which made it possible to create projections of these reference counted pointers. Unlike the original reference counted pointers, these projections could...

Italtel i-MCS NFV 安全漏洞

Italtel i-MCS NFV is an IMS/NGN core and border suite from Italtel, Italy. A security vulnerability exists in Italtel i-MCS NFV version 12.1.0-20211215. A remote attacker can exploit the vulnerability to inject arbitrary web script or HTML...

asteval 1.06 Arbitrary Code Execution / Sandbox Escape Vulnerabilities

An attacker who can pass input to the asteval library, when this is used with numpy functions in the symbol table the default setting, can bypass restrictions and execute arbitrary code as the user who ran the python process. Versions 1.06 and below are affected. CVE pending Sandboxing Python is...

Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits

The China-nexus cyber espionage group tracked as UNC3886 has been observed targeting end-of-life MX Series routers from Juniper Networks as part of a campaign designed to deploy custom backdoors, highlighting their ability to focus on internal networking infrastructure. "The backdoors had varying...

CVE-2025-25565

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a command line...

CVE-2025-25565

SoftEther VPN 5.02.5187 is affected by CVE-2025-25565 due to a Buffer Overflow in the Command.c file, exploitable via the PtMakeCert and PtMakeCert2048 functions. Records consistently describe a buffer overflow in these functions; the supplier disputes the claim (the provider notes the behavior c...