22784 matches found
WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin UPC/EAN/GTIN Code Generator versions = 2.0.2...
Mango discloses data breach at third-party provider
Mango has reported a data breach at one of its external marketing service providers. The Spanish fashion retailer says that only personal contact information has been exposed—no financial data. The breach took place at the service provider and did not affect Mango’s own systems. According to the...
CVE-2025-9967
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...
CGA-MFRH-2VH3-PF36
Bulletin has no description...
EUVD-2025-34687
Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing...
EUVD-2025-34688
Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities...
Scammers are still sending us their fake Robinhood security alerts
A short while ago, our friends at Malwaretips wrote about a text scam impersonating Robinhood, a popular US-based investment app that lets people trade stocks and cryptocurrencies. The scam warns users about supposed “suspicious activity” on their accounts. As if to demonstrate that this phishing...
Recommended update of flake-pilot
This update for flake-pilot fixes the following issues: Update version to 3.1.22. Fixes to use flakes as normal user Running a flake is a container based instance provisioning and startup. Some part of this process requires root permissions for example mounting the container instance store for th...
K000148816: BIG-IP APM and SSL Orchestrator vulnerability CVE-2025-47148
Security Advisory Description When the BIG-IP system is configured as both a Security Assertion Markup Language SAML service provider SP and Identity Provider IdP, with single logout SLO enabled on an access policy, undisclosed requests can cause an increase in memory resource utilization...
CVE-2025-9967
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...
EUVD-2025-34545
The Orion SMS OTP Verification plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.7. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for...
CVE-2025-9967
CVE-2025-9967 concerns the WordPress plugin Orion SMS OTP Verification. The vulnerability is an authentication bypass enabling privilege escalation via account takeover in versions
CVE-2025-39999
The CVE-2025-39999 issue affects the Linux kernel’s blk-mq path, where tags growth via the sysfs nr_requests attribute can lead to a double free: hctx->sched_tags is freed while et->tags (the allocated tags) has already been freed, risking a kernel panic during elevator exit. The documented...
EUVD-2025-34512
The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.0. This is due to the plugin assigning the editor role by default. While limitations with respect to capabiliti...
CVE-2025-55679 Windows Kernel Information Disclosure Vulnerability
...
JLSEC-2025-41 In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to...
In libexpat before 2.2.8, crafted XML input could fool the parser into changing from DTD parsing to document parsing too early; a consecutive call to XMLGetCurrentLineNumber or XMLGetCurrentColumnNumber then resulted in a heap-based buffer over-read...
PT-2025-42226
CVE-2025-56224 CVE-2025-56224 OTP verification Bypass Description an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code. CVSS Score https://t.co/9m2AguFoY6...
CVE-2025-10552
creationtimestamp| type| source ---|---|--- 2025-10-13 08:13:37+00:00| seen| Telegram/BfNOQEW6DeJUKOC7RMZRp7ey-OCqnqNoJBCAFbDAuT0s...
WordPress Customify plugin cross-site request forgery vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress Customify plugin, which stems from missing or incorrect random number validation in the resetcustomizesection...