CVE-2025-46690

Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request...

CVE-2025-46657

Karaz Karazal through 2025-04-14 allows reflected XSS via the lang parameter to the default URI...

CVE-2025-54252

creationtimestamp| type| source ---|---|--- 2025-04-27 11:00:39+00:00| seen| https://bsky.app/profile/ardacetin.org/post/3lns3x6754s2n 2025-04-27 11:00:39+00:00| seen| https://bsky.app/profile/ardacetin.org/post/3lns3x66qgk2n 2025-04-27 11:00:40+00:00| seen|...

CVE-2025-3962

creationtimestamp| type| source ---|---|--- 2025-04-27 07:09:13+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13606 2025-04-27 07:35:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnrqil2sr62d 2025-04-27 10:28:06+00:00| seen|...

CVE-2025-46673

creationtimestamp| type| source ---|---|--- 2025-04-27 01:08:30+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13591 2025-04-27 01:48:41+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114407408963291150 2025-04-27 03:35:26+00:00| seen|...

On the Prevalence and Usage of Commit Signing on GitHub: a Longitudinal and Cross-Domain Study

GitHub is one of the most widely used public code development platform. However, the code hosted publicly on the platform is vulnerable to commit spoofing that allows an adversary to introduce malicious code or commits into the repository by spoofing the commit metadata to indicate that the code...

CVE-2025-46688

quickjs-ng through 0.9.0 has an incorrect size calculation in JSReadBigInt for a BigInt, leading to a heap-based buffer overflow. QuickJS before 2025-04-26 is also affected...

CVE-2025-46653

Formidable aka node-formidable 2.1.0 through 3.x before 3.5.3 relies on hexoid to prevent guessing of filenames for untrusted executable content; however, hexoid is documented as not "cryptographically secure." Also, there is a scenario in which only the last two characters of a hexoid string nee...

CVE-2025-29456

An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function...

CVE-2025-31200

A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware ...

CVE-2025-25045

IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request. This information could be used in further attacks against the system...

CVE-2025-3825

A vulnerability, which was classified as problematic, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this issue is some unknown functionality of the file add-category.php. The manipulation of the argument txtcategoryname leads to cross site scriptin...

CVE-2025-46656

python-markdownify aka markdownify before 0.14.1 allows large headline prefixes such as in addition to through . This causes memory consumption...

CVE-2025-32513

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Reflected XSS.This issue affects Nomupay Payment Processing Gateway: from n/a through = 7.1.6...

CVE-2025-3640

creationtimestamp| type| source ---|---|--- 2025-04-25 17:19:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq75utke2h...

CVE-2025-3637

creationtimestamp| type| source ---|---|--- 2025-04-25 17:19:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnnq75qqeu2s 2025-04-25 19:11:25+00:00| seen| https://t.me/cvedetector/23777...

CVE-2025-39421

Cross-Site Request Forgery CSRF vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky Side Buttons: from n/a through = 2.1...

CVE-2025-46433

In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible...

CVE-2025-3645

A flaw was found in Moodle. Insufficient capability checks in a messaging web service allowed users to view other users' names and online statuses...

CVE-2025-3628

A flaw has was found in Moodle where anonymous assignment submissions can be de-anonymized via search, revealing student identities...