22917 matches found
CVE-2025-1408 ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdeclinejoingrouprequest and pmapprovejoingrouprequest functions in all versions up to, and including, 5.9.4.4. This makes it...
PT-2025-12474
Name of the Vulnerable Software and Affected Versions Multi Video Box plugin for WordPress versions up to, and including, 1.5.2 Description The issue is related to Reflected Cross-Site Scripting via the video id and group id parameters due to insufficient input sanitization and output escaping...
PT-2025-12465
Name of the Vulnerable Software and Affected Versions The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress versions up to, and including, 5.9.4.4 Description The issue is related to unauthorized modification of data due to a missing capability check on the pm decline join...
WordPress Multi Video Box plugin <= 1.5.2 - Reflected Cross-Site Scripting via video_id and group_id Parameters vulnerability
Reflected Cross-Site Scripting via videoid and groupid Parameters vulnerability discovered by johska in WordPress Plugin Multi Video Box versions = 1.5.2...
CVE-2025-30345
OpenSlides CVE-2025-30345 affects OpenSlides versions prior to 4.2.5. The vulnerability arises in the chat_group.create action: while some HTML elements (e.g., SCRIPT) are filtered, others are not, and HTML entities are not consistently encoded when deleting chats or deleting messages, potentiall...
Targeted spyware and why it’s a concern to us
Experts are again warning about the proliferating market for targeted spyware and espionage. Before we dive into the world of targeted spyware, it's worth looking at a few of the main players that are active in and against this industry. Paragon Solutions is an Israeli company which sells high-en...
GHSA-PGR7-MHP5-FGJP vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object
vllm-project vllm version 0.6.0 contains a vulnerability in the distributed training API. The function vllm.distributed.GroupCoordinator.recvobject deserializes received object bytes using pickle.loads without sanitization, leading to a remote code execution vulnerability. Maintainer perspective...
CVE-2025-0655
Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-55890. Notes: All CVE users should reference CVE-2024-55890 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2024-9016
Rejected reason: REJECT DO NOT USE THIS CVE ID NUMBER. The Rejected CVE Record is a duplicate of CVE-2024-45595. Notes: All CVE users should reference CVE-2024-45595 instead of this CVE Record. All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2025-0655
CVE-2025-0655 is a duplicate of CVE-2024-55890. Connected sources describe a D-Tale (dtale) RCE affecting dtale versions around 3.15.1 where an attacker can override global state to enable enable_custom_filters, then abuse the /test-filter endpoint to execute arbitrary commands, with the fix in 3...
CVE-2024-11167
Affected software/version : danny-avila/librechat
CVE-2024-9016
CVE-2024-9016 affects D-Tale (Man Group) for Pandas data structures, where versions
PT-2025-12261
Name of the Vulnerable Software and Affected Versions vllm-project vllm version 0.6.0 Description The issue concerns a remote code execution vulnerability in the distributed training API. Specifically, the vllm.distributed.GroupCoordinator.recv object function deserializes received object bytes...
PT-2025-12319 · Man · D-Tale
Name of the Vulnerable Software and Affected Versions: man-group/dtale version 3.15.1 Description: A vulnerability in man-group/dtale allows an attacker to override global state settings to enable the enable custom filters feature, which is typically restricted to trusted environments. Once...
PT-2025-12260
Name of the Vulnerable Software and Affected Versions man-group dtale versions = 3.13.1 Description The issue allows for unauthenticated remote command execution via the df.query method when the query engine is set to 'python'. This is due to the query parameters from the request being directly...
Azure Linux 3.0 Security Update: libcap (CVE-2025-1390)
The version of libcap installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-1390 advisory. - The PAM module pamcap.so of libcap configuration supports group names starting with @, during actual parsing,...
Fake BianLian Ransomware Letters in Circulation
At a glance: The FBI is warning of a mail-based fraud involving letters sent to businesses in the U.S. These letters resemble online ransomware notes demanding payment via Bitcoin. Rapid7 examined a mail-based ransom demand sent to a customer from a local postcode. There is no evidence that any o...