CVE-2025-1565 Mayosis Core <= 5.4.1 - Unauthenticated Arbitrary File Read

The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remotedl.php file. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain...

CVE-2025-3775

creationtimestamp| type| source ---|---|--- 2025-04-25 05:08:58+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13378 2025-04-25 05:42:36+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lnmiyzlvwvb2 2025-04-25 09:09:17+00:00| seen|...

CVE-2025-46599

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing...

Fedora: Security Advisory (FEDORA-2025-2280949271)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-46617

Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and...

CVE-2025-43861

creationtimestamp| type| source ---|---|--- 2025-04-24 21:07:11+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13346 2025-04-24 23:52:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlvo2d27t2v 2025-04-25 00:47:40+00:00| seen|...

GHSA-VQFR-H8MV-GHFJ

creationtimestamp| type| source ---|---|--- 2025-04-24 19:09:03+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114394512917622666...

CVE-2025-39377

creationtimestamp| type| source ---|---|--- 2025-04-24 17:48:12+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114394194942049906 2025-04-24 18:14:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlcsewgoz2d 2025-04-25 14:07:25+00:00| seen|...

CVE-2025-46489 WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through = 2.1...

CVE-2025-46525 WordPress WP Cookie Consent plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Stored XSS.This issue affects WP Cookie Consent: from n/a through = 1.0...

CVE-2025-46504 WordPress Vasaio QR Code plugin <= 1.2.5 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Olar Marius Vasaio QR Code allows Stored XSS. This issue affects Vasaio QR Code: from n/a through 1.2.5...

CVE-2025-46264 WordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue affects PowerPress Podcasting: from n/a through = 11.12.5...

CVE-2025-27820

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release...

CVE-2025-46272

creationtimestamp| type| source ---|---|--- 2025-04-24 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-06 2025-04-25 00:19:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnlx7ktjya2r 2025-04-25 01:30:05+00:00| seen|...

CVE-2025-1284

creationtimestamp| type| source ---|---|--- 2025-04-24 09:12:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13207 2025-04-24 13:03:56+00:00| seen| https://t.me/cvedetector/23668 2025-04-24 14:19:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnkvntudhh24...

CVE-2025-3280

creationtimestamp| type| source ---|---|--- 2025-04-24 09:12:11+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13199 2025-04-24 13:03:42+00:00| seen| https://t.me/cvedetector/23657 2025-04-24 14:19:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnkvntqegp2d...

CVE-2025-3065 Database Toolset <= 1.8.4 - Unauthenticated Arbitrary File Deletion

The Database Toolset plugin is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and including, 1.8.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote co...

Threat Replay Testing: Turning Attackers into Pen Testers

API security is no longer just a concern; it’s a critical priority for businesses. With APIs serving as the backbone of modern applications, they’ve become a primary target for attackers. While automated security testing tools help detect vulnerabilities, their limitations leave organizations...

CVE-2025-41423

Mattermost CVE-2025-41423 affects Mattermost versions 10.4.x up to 10.4.2, 10.5.x up to 10.5.0, and 9.11.x up to 9.11.10. The issue is improper permission validation on the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignore-thread, which could allow any user or attacker to delete posts...

CVE-2025-27581

creationtimestamp| type| source ---|---|--- 2025-04-24 00:05:21+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13164 2025-04-24 01:14:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnjjst5wtw2s 2025-04-24 04:42:07+00:00| seen|...