471 matches found
CVE-2025-43904
In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator...
CVE-2025-43904
In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator...
CVE-2025-43904
In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator...
CVE-2023-40622
SAP BusinessObjects Business Intelligence Platform Promotion Management - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can completely compromise the application...
SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm36 / perl-slurm / slurm / etc (SUSE-SU-2025:02779-1)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:02779-1 advisory. - CVE-2025-43904: an issue with permission handling for Coordinators within the accounting system allowed Coordinators to promote a user to...
EUVD-2025-199495
Malicious code in @kvytech/medusa-plugin-promotion npm...
CVE-2025-11620 Multiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation
The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpuaddmultiplerolesui' and 'mrpusavemultipleuserroles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated...
EUVD-2025-197949
The Multiple Roles per User plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mrpuaddmultiplerolesui' and 'mrpusavemultipleuserroles' functions in all versions up to, and including, 1.0. This makes it possible for authenticated...
Wordfence Intelligence Weekly WordPress Vulnerability Report (November 3, 2025 to November 9, 2025)
Calling all Vulnerability Researchers and Bug Bounty Hunters! The LFInder Challenge:Refine your LFI hunting skills with an expanded scope. Now through November 24, 2025, all LFI vulnerabilities in software with at least 25 active installs are considered in-scope for all researchers, regardless of...
MAL-2025-180757 Malicious code in teate-thy-sonic-nowef (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6b8c079c9905441bf93f58dccc9a644e0414bbf14ba6101370bffecf50b95a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
UBUNTU-CVE-2025-40159
In the Linux kernel, the following vulnerability has been resolved: xsk: Harden userspace-supplied xdpdesc validation Turned out certain clearly invalid values passed in xdpdesc from userspace can pass xp,unalignedvalidatedesc and then lead to UBs or just invalid frames to be queued for xmit...
CVE-2025-40159
CVE-2025-40159 applies to the Linux kernel’s XSK/XDP path. The issue arises from accepting clearly invalid userspace-provided xdp_desc values, allowing validation to pass under certain overflow conditions. Root cause: desc->len can reach values near U32_MAX, and desc->addr (u64) can interac...
MAL-2025-137315 Malicious code in tiara-ruwet6-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 526802fa15e31bbb9b3f643c9b6f31a9a8d738ee0a0cda8989cb790df485e5e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-90733 Malicious code in sporting_caterpillar_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7589ca112338abf6bcad91da1db2dc3a319643686568bebf7a6ae71f82091cfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in budi-keripik37-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869eba999d57242086375394d84a012d11b7e7017cbe59020b81ad78f2073bb4 The package budi-keripik37-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...
PromoGuardian: Detecting Promotion Abuse Fraud with Multi-Relation Fused Graph Neural Networks
As e-commerce platforms develop, fraudulent activities are increasingly emerging, posing significant threats to the security and stability of these platforms. Promotion abuse is one of the fastest-growing types of fraud in recent years and is characterized by users exploiting promotional activiti...
Rewiring Democracy is Coming Soon
My latest book, Rewiring Democracy: How AI Will Transform Our Politics, Government, and Citizenship , will be published in just over a week. No reviews yet, but you can read chapters 12 and 34 of 43 chapters total. You can order the book pretty much everywhere, and a copy signed by me here. Pleas...
Are LLMs Reliable Rankers? Rank Manipulation Via Two-Stage Token Optimization
Large language models LLMs are increasingly used as rerankers in information retrieval, yet their ranking behavior can be steered by small, natural-sounding prompts. To expose this vulnerability, we present Rank Anything First RAF, a two-stage token optimization method that crafts concise textual...