CVE-2025-46041

creationtimestamp| type| source ---|---|--- 2025-06-09 19:40:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr752khs342p 2025-06-09 20:31:31+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17773 2025-06-16 21:02:29+00:00| seen|...

CVE-2025-48123

creationtimestamp| type| source ---|---|--- 2025-06-09 18:43:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr6zugyhmf2p...

Regular expression Denial of Service - ReDoS

Description A regular expression denial of service ReDoS vulnerability has been identified in the Hugging Face Transformers library's CLVP number normalizer. The vulnerability exists in the normalizenumbers method of the EnglishNormalizer class, which converts numeric strings to their English wor...

CVE-2025-31061 WordPress Wishlist plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in redqteam Wishlist wishlist allows Reflected XSS.This issue affects Wishlist: from n/a through = 2.1.0...

CVE-2025-39539 WordPress WP Email Delivery plugin <= 1.20.11.23 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brewlabs WP Email Delivery wp-email-delivery allows Reflected XSS.This issue affects WP Email Delivery: from n/a through = 1.20.11.23...

CVE-2025-49138

creationtimestamp| type| source ---|---|--- 2025-06-09 15:01:00+00:00| published-proof-of-concept| https://github.com/haxtheweb/issues/security/advisories/GHSA-hxrr-x32w-cg8g 2025-06-09 21:31:58+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/17784 2025-06-10...

A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account

Phone numbers are a gold mine for SIM swappers. A researcher found how to get this precious piece of information through a clever brute-force attack...

CVE-2025-38003

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcmop which is in the process to be removed the procfs output might show unreliable data UAF. As the removal of bcmop's is...

Understanding the Error Sensitivity of Privacy-Aware Computing

Homomorphic Encryption HE enables secure computation on encrypted data without decryption, allowing a great opportunity for privacy-preserving computation. In particular, domains such as healthcare, finance, and government, where data privacy and security are of utmost importance, can benefit fro...

CVE-2025-35009 Microhard Bullet-LTE and IPn4Gii AT+MNNETSP Argument Injection

Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command...

CVE-2025-35007

CVE-2025-35007 affects Microhard BulletLTE-NA2 and IPn4Gii-NA2. Reported vulnerability is a post-authentication command injection in the AT+MFRULE command, falling under CWE-88 (Argument Injection) and enabling privilege escalation. CVSS v3.1 base score 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); ...

CVE-2025-32457 ON Semiconductor Quantenna router_command.sh (in the get_file_from_qtn argument) Argument Injection

The Quantenna Wi-Fi chipset ships with a local control script, routercommand.sh in the getfilefromqtn argument, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command 'Argument Injection'," and is estimated as a CVSS...

CVE-2025-27242

creationtimestamp| type| source ---|---|--- 2025-06-08 15:05:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr457crqbm2m...

CVE-2025-30981

Cross-Site Request Forgery CSRF vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14...

CVE-2025-28986

Cross-Site Request Forgery CSRF vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from n/a through = 1.5...

CVE-2025-30084

A stored XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 for Joomla was discovered. The issue occurs within the dashboard component, where user-supplied input is not properly sanitized before being stored and rendered. An attacker can inject malicious JavaScript code into text fields or...

CVE-2025-3054

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

VulnCheck KEV: CVE-2021-0027

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2021. Notes: none...

Fedora 42 : mod_security (2025-7faa0bc6e5)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-7faa0bc6e5 advisory. This update includes modsecurity version 2.9.9 which addresses CVE-2025-47947 and includes various bug fixes. See...

CVE-2025-5480

Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to explo...