CVE-2025-32962 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS...

CVE-2025-4753

creationtimestamp| type| source ---|---|--- 2025-05-16 09:03:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboaj3uny2h...

CVE-2025-3624

creationtimestamp| type| source ---|---|--- 2025-05-16 09:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboaijpma2h...

CVE-2025-4679

A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors...

CVE-2025-3875

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name [email protected]...

CVE-2025-4735

creationtimestamp| type| source ---|---|--- 2025-05-16 02:33:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16610 2025-05-16 05:07:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpbb3twuaz2h...

CVE-2025-4731 TOTOLINK A3002R/A3002RU HTTP POST Request formPortFw buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formPortFw of the component HTTP POST Request Handler. The manipulation of the argument servicetype/ipsubnet leads to buffer overflow. It is...

CVE-2025-48174

In libavif before 1.3.0, makeRoom in stream.c has an integer overflow and resultant buffer overflow in stream-offset+size...

CVE-2025-47275

Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, session cookies of applications using the Auth0-PHP SDK configured with CookieStore have authentication tags that can be brute forced, which may result in...

CVE-2025-20041

Uncontrolled search path for some IntelR Graphics software for IntelR Arc™ graphics and IntelR IrisR Xe graphics before version 32.0.101.6325/32.0.101.6252 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-13357

creationtimestamp| type| source ---|---|--- 2025-05-15 20:46:07+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaf2lnear2f...

CVE-2024-6335

creationtimestamp| type| source ---|---|--- 2025-05-15 20:37:15+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaekssgag2f...

CVE-2025-46834

Alchemy's Modular Account is a smart contract account that is compatible with ERC-4337 and ERC-6900. In versions on the 2.x branch prior to commit 5e6f540d249afcaeaf76ab95517d0359fde883b0, owners of Modular Accounts can grant session keys scoped external keys to external parties and would use the...

CVE-2025-0688

CVE-2025-0688 affects the WordPress plugin Spiritual Gifts Survey (and S.H.A.P.E. survey) versions ≤ 0.9.10. The vulnerability arises because a parameter is not sanitized/escaped before being echoed in the page, producing a reflected XSS. Exploitation could impact unauthenticated users and is des...

CVE-2024-9662 CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings

The CYAN Backup WordPress plugin before 2.5.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-8082 Widgets Reset <= 0.1 - Settings Update via CSRF

The Widgets Reset WordPress plugin through 0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8032 Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSS

The Smooth Gallery Replacement WordPress plugin through 1.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-13621 The GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS

The GDPR Framework By Data443 WordPress plugin before 2.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2025-30475

creationtimestamp| type| source ---|---|--- 2025-05-15 19:19:04+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114513460850440442 2025-05-15 22:37:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpalbvcgu32h...

CVE-2025-30419

creationtimestamp| type| source ---|---|--- 2025-05-15 19:02:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpa7b7ipks2p 2025-05-20 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-02...