CVE-2025-11467

CVE-2025-11467 affects the WordPress plugin “RSS Aggregator by Feedzy” (Feedzy RSS/Feedzy RSS Feeds). The vulnerability is a Blind Server-Side Request Forgery in the feedzy_lazy_load function, exploitable in all versions up to and including 5.1.1. It allows unauthenticated attackers to issue web ...

luksmeta: Data corruption when handling LUKS1 partitions with luksmeta

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...

WordPress RSS Aggregator by Feedzy plugin <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery vulnerability

Unauthenticated Blind Server-Side Request Forgery vulnerability discovered by Lucas Montes Nirox in WordPress Plugin Feedzy versions = 5.1.1...

CVE-2025-65807

An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command...

CVE-2025-67495

ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoint. The /logout endpoint insecurely routes to a value that is supplied in the postlogoutredirect GET parameter. As a result, unauthenticate...

SHADOW-VOID-042 Targets Multiple Industries with Void Rabisu-like Tactics

In November, a targeted spear-phishing campaign was observed using Trend Micro-themed lures against various industries, but this was quickly detected and thwarted by the Trend Vision One™ platform...

TeamViewer DEX Client 安全漏洞

TeamViewer DEX Client is a digital employee experience and endpoint management software from TeamViewer Germany. A security vulnerability exists in TeamViewer DEX Client versions prior to V17.1 that stems from improper handling of executable search paths, which could lead to elevation of privileg...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.25 (SUSE-SU-2025:4336-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4336-1 advisory. go1.25.5 released 2025-12-02 includes two security fixes to the crypto/x509 package, as well as...

TeamViewer DEX Client 安全漏洞

TeamViewer DEX Client is a digital employee experience and endpoint management software from TeamViewer Germany. A security vulnerability exists in versions prior to TeamViewer DEX Client V21 that stems from improper input validation and could lead to remote execution of arbitrary commands...

Ruijie RG-EW1200G PRO 安全漏洞

Ruijie RG-EW1200G PRO is a wireless router from China Ruijie Ruijie. A security vulnerability exists in the Ruijie RG-EW1200G PRO V1.00/V2.00/V3.00/V4.00 versions, which originates from unverified input to the moduleset function in the file /usr/local/lua/devconfig/configretain.lua, which could...

Form.io 信息泄露漏洞

Form.io is a combined forms and API platform for serverless applications from US-based Form.io. An information disclosure vulnerability exists in Form.io versions prior to 3.5.6 and 4.0.0-rc.1 through 4.4.2, which stems from a flaw in path handling that could lead an attacker to access a protecte...

Fedora 43 : wireshark (2025-0e41e63705)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-0e41e63705 advisory. New version 4.6.1. Beware of the move of files from /usr/lib64/wireshark/extcap/ to /usr/libexec/wireshark/extcap. Any custom user scripts should be...

Ruijie X30 PRO 安全漏洞

Ruijie X30 PRO is a home wireless router from China Ruijie Ruijie. A security vulnerability exists in the Ruijie X30 PRO V1 X30-PRO-V109241521 version, which originates from an unvalidated input to the moduleget function in the file /usr/local/lua/devsta/networkConnect.lua, which could lead to an...

IBM Aspera Orchestrator 安全漏洞

IBM Aspera Orchestrator is an automated workflow engine focused on managing file transfers and processing tasks. An unauthenticated password change vulnerability exists in IBM Aspera Orchestrator, which can be exploited by an attacker to make unauthorized changes to other users' passwords...

CVE-2025-67505

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another...

CVE-2025-36437

IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system...

CVE-2025-67505 Race condition in the Okta Java SDK

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another...

CVE-2025-67505 Race condition in the Okta Java SDK

Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another...

Race condition in the Okta Java SDK

Description In the Okta Java SDK, race conditions may arise from concurrent requests using the ApiClient class. This could cause a status code or response header from one request’s response to influence another request’s response. Affected product and versions You may be affected if you meet the...

GHSA-WCGJ-F865-C7J7 Improper Request Caching Lookup in the Auth0 Next.js SDK

Description When using affected versions of the Next.js SDK, simultaneous requests on the same client may result in improper lookups in the TokenRequestCache for the request results. Am I Affected? You are affected if you meet the following preconditions: - Applications using the auth0/nextjs-aut...