CVE-2025-51495

An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the application to crash. If downstream vendors integrate this component improperly, the issue may lead to a buffer overflow...

Pentesting-Assistant

Pentesting-Assistant AI-powered penetration testing assist...

CVE-2025-9894

The Sync Feedly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the crsfcronjobfunc function. This makes it possible for unauthenticated attackers to trigger content synchronizati...

CVE-2025-9894

CVE-2025-9894 affects the Sync Feedly WordPress plugin (versions

CVE-2025-60173

CVE-2025-60173 : GST for WooCommerce (plugin) has a CSRF flaw that enables Stored XSS in versions up to 2.0. The NVD entry lists a CVSS v3.1 base score of 7.1 (HIGH) with NETWORK attack vector, UI required, and updated as of 2026-01-27. Connected sources corroborate the vendor/plugin (GST for Woo...

Jenkins Unauthenticated Access

Jenkins is an open-source automation server used to automate various aspects of software development, including building, testing, and deploying application. If authentication is not enforced, an attacker can gain administrative access to Jenkins, potentially allowing for the execution of arbitra...

CVE-2025-58669

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

CVE-2025-58666

Missing Authorization vulnerability in Kommo Website Chat Button: Kommo integration website-chat-button-kommo-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Website Chat Button: Kommo integration: from n/a through = 1.3.1...

CVE-2025-36202

IBM webMethods Integration 10.15 and 11.1 could allow an authenticated user with required execute Services to execute commands on the system due to the improper validation of format string strings passed as an argument from an external source...

CVE-2025-36037

IBM webMethods Integration 10.15 and 11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

cosmos-predict2 (>=1.0.6 <=1.0.9), frankenstein-model (>=5.1.6 <=5.3.9) +8 more potentially affected by CVE-2025-23349 via megatron-core (=0.10.0)

megatron-core PYPI version =0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on megatron-core and may be impacted: - cosmos-predict2 =1.0.6, =5.1.6, =1.0.0, =2.0.8, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.9 Source cves: CVE-2025-23349...

org.apache.iotdb:integration-test (>=1.3.3 <=2.0.1-beta), org.apache.iotdb:iotdb-distribution (>=1.3.3 <=2.0.1-beta) potentially affected by CVE-2025-48459 via org.apache.iotdb:iotdb-confignode (>=1.3.3 <=2.0.1-beta)

org.apache.iotdb:iotdb-confignode MAVEN version =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta Source cves: CVE-2025-48459 Source advisory: OSV:GHSA-776Q-JW43-FHJX...

org.apache.iotdb:integration-test (>=1.3.3 <=2.0.1-beta), org.apache.iotdb:iotdb-distribution (>=1.3.3 <=2.0.1-beta) potentially affected by CVE-2025-48459 via org.apache.iotdb:iotdb-confignode (>=1.3.3 <=2.0.1-beta)

org.apache.iotdb:iotdb-confignode MAVEN version =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta Source cves: CVE-2025-48459 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-13053298...

Investigating Security Implications of Automatically Generated Code on the Software Supply Chain

In recent years, various software supply chain SSC attacks have posed significant risks to the global community. Severe consequences may arise if developers integrate insecure code snippets that are vulnerable to SSC attacks into their products. Particularly, code generation techniques, such as...

STAF: Leveraging LLMs for Automated Attack Tree-Based Security Test Generation

In modern automotive development, security testing is critical for safeguarding systems against increasingly advanced threats. Attack trees are widely used to systematically represent potential attack vectors, but generating comprehensive test cases from these trees remains a labor-intensive,...

fleetdeck-poc

FleetDeck PoC !Go Versionhttps://img.shields.io/badge/go-...

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

GitHub on Monday announced that it will be changing its authentication and publishing options "in the near future" in response to a recent wave of supply chain attacks targeting the npm ecosystem, including the Shai-Hulud attack. This includes steps to address threats posed by token abuse and...

CVE-2025-58669

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Modern Minds Magento 2 WordPress Integration m2wp allows Stored XSS.This issue affects Magento 2 WordPress Integration: from n/a through = 1.4.2.1...

CVE-2025-57914

Cross-Site Request Forgery CSRF vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Cross Site Request Forgery.This issue affects Deliver via Shipos for WooCommerce: from n/a through = 3.0.2...

WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Vinit Lakra in WordPress Plugin Magento 2 WordPress Integration versions = 1.4.2.1...