CVE-2025-22146 Improper authentication on SAML SSO process allows user impersonation in sentry

Sentry is a developer-first error tracking and performance monitoring tool. A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account by using a...

CVE-2023-27531

CVE-2023-27531 affects the Kredis JSON deserialization path. Vulnerable: Kredis versions prior to 1.3.0.1 where untrusted JSON data can be deserialized, potentially leading to deserialization of unexpected objects. Impact: any applications using Kredis with JSON are affected. Mitigation: upgrade ...

CVE-2024-27980

Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...

CVE-2023-28120

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input...

CVE-2023-28120

CVE-2023-28120 affects ActiveSupport: invoking the new bytesplice method on a SafeBuffer with untrusted input can lead to cross-site scripting (CWE-79). Connected sources confirm the vulnerability exists, but the provided documents do not specify affected versions or a fixed patch version. There ...

CVE-2023-38037

CVE-2023-38037 affects Rails’ ActiveSupport::EncryptedFile, which writes data to a temporary file with permissions derived from the user’s umask. The temporary file could be readable by other users on the same system while a user edits it, enabling local information disclosure. Public documents f...

CVE-2023-35685

CVE-2023-35685 describes a logic error in DevmemIntMapPages within the file devicemem_server.c that can cause a physical page use-after-free. This USE-After-FREE condition could enable local privilege escalation in the kernel without requiring additional execution privileges or user interaction. ...

CVE-2025-22215

VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...

CVE-2025-22215 VMSA-2025-0001: VMware Aria automation update addresses a server side request forgery vulnerability (CVE-2025-22215)

VMware Aria Automation contains a server-side request forgery SSRF vulnerability. A malicious actor with "Organization Member" access to Aria Automation may exploit this vulnerability enumerate internal services running on the host/network...

PT-2025-1891 · WordPress · Chative Live Chat/Chatbot Plugin

Name of the Vulnerable Software and Affected Versions: Chative Live chat and Chatbot plugin for WordPress versions up to, and including, 1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the add chative widget action function. This...

CVE-2024-5594

OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs...

CVE-2024-5594

OpenVPN vulnerability CVE-2024-5594: before version 2.6.11, PUSH_REPLY messages are not sanitized, allowing a server-controlled attacker to inject arbitrary data into client logs. The issue is documented as a high-severity, network-exposure risk (CVSS v3.1: 9.1). The root cause is improper saniti...

From $22M in Ransom to +100M Stolen Records: 2025's All-Star SaaS Threat Actors to Watch

In 2024, cyber threats targeting SaaS surged, with 7,000 password attacks blocked per second just in Entra ID—a 75% increase from last year—and phishing attempts up by 58%, causing $3.5 billion in losses source: Microsoft Digital Defense Report 2024. SaaS attacks are increasing, with hackers ofte...

CVE-2023-23672

CVE-2023-23672 concerns WordPress plugin GiveWP (Liquid Web/StellarWP) up to version 2.25.1, with a Missing Authorization vulnerability in a function affecting content deletion. The issue allows an authenticated user with Contributor privileges to delete arbitrary content due to insufficient auth...

CVE-2023-45272

CVE-2023-45272 affects WordPress plugin 10Web Map Builder for Google Maps (versions

CVE-2023-45633

CVE-2023-45633 describes a Missing Authorization vulnerability (Broken Access Control) in WordPress IMPress Listings plugin (versions n/a–2.6.2). The root cause is incorrectly configured access control security levels, enabling unauthenticated users to access restricted functionality. Reported CV...

CVE-2022-41995

CVE-2022-41995 concerns the WordPress plugin Gallery Images Ape, affected versions 2.2.8 and earlier. Multiple connected sources describe a Missing Authorization / Broken Access Control vulnerability, caused by incorrectly configured access control security levels in the Gallery Images Ape plugin...

CVE-2023-47778

CVE-2023-47778 concerns LuckyWP Scripts Control for WordPress. The vulnerability is a Missing Authorization/Broken Access Control issue in LuckyWP Scripts Control versions

CVE-2023-47807

CVE-2023-47807 — Missing Authorization in WordPress plugin 10WebAnalytics (

CVE-2023-48739

CVE-2023-48739 affects the Porto Theme - Functionality WordPress plugin (pre-2.12.1). The issue is a Missing/Broken Access Control vulnerability allowing unauthenticated access due to incorrectly configured authorization. The CVSSv3.1 base score is 5.3 (Medium) with Low availability impact per Pa...