CVE-2025-4921

Rejected reason: Duplicate of CVE-2025-4919...

CVE-2025-4919

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...

CVE-2025-47273

creationtimestamp| type| source ---|---|--- 2025-05-17 17:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpf22qx2g72w 2025-05-24 17:50:57+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lpwphn64oc2g 2025-05-24 20:27:37+00:00| seen|...

CVE-2025-47273

CVE-2025-47273 affects setuptools by a path traversal in PackageIndex prior to 78.1.1, allowing writing files to arbitrary locations with the process’s permissions and potentially enabling remote code execution in context. Affected: setuptools package (Python ecosystem). The issue is fixed in ver...

CVE-2025-4101 MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion

The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'deletefpmproduct' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated...

CVE-2025-4824 TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWsc buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possib...

Security Bulletin: Vulnerability in path-to-regexp affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in path-to-regexp has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-31637

creationtimestamp| type| source ---|---|--- 2025-05-16 18:37:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcodn4l6r2r...

CVE-2025-0130

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this...

CVE-2025-47534

Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through = 3.25.0...

CVE-2025-31923

Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through = 3.0...

CVE-2025-40906

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON...

CVE-2025-48080

creationtimestamp| type| source ---|---|--- 2025-05-16 15:54:23+00:00| seen| https://bsky.app/profile/potato.software/post/3lpcf7wb6kv2g 2025-05-16 16:34:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16698...

CVE-2025-47792

Nextcloud Desktop is the desktop sync client for Nextcloud. In versions of Nextcloud Desktop prior to 3.15, 3rdparty applications already installed on a user machine can create link shares for almost all data via the socket API. These shares can then be easily sent off to an external service...

CVE-2025-32962 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS...

CVE-2025-4753

creationtimestamp| type| source ---|---|--- 2025-05-16 09:03:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboaj3uny2h...

CVE-2025-3624

creationtimestamp| type| source ---|---|--- 2025-05-16 09:03:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboaijpma2h...

CVE-2025-4679

A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors...

CVE-2025-3875

The Mozilla Foundation's Security Advisory describes the following issue: Thunderbird parses addresses in a way that can allow sender spoofing in case the server allows an invalid From address to be used. For example, if the From header contains an invalid value "Spoofed Name [email protected]...

CVE-2025-4735

creationtimestamp| type| source ---|---|--- 2025-05-16 02:33:56+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16610 2025-05-16 05:07:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpbb3twuaz2h...