4993 matches found
CVE-2025-32680 WordPress Review Stream plugin <= 1.6.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Grade Us, Inc. Review Stream allows Stored XSS. This issue affects Review Stream: from n/a through 1.6.7...
CVE-2025-32680
CVE-2025-32680 is an authenticated Stored XSS in Review Stream (WordPress plugin) by Grade Us, Inc. The vulnerability affects Review Stream versions up to and including 1.6.7. Public details indicate improper neutralization of input during web page generation, enabling stored cross-site scripting...
WordPress plugin Review Stream θ·¨η«θζ¬ζΌζ΄
WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
The vulnerability of the Yelp review system lies in the fact that functions from an unreliable and uncontrolled area are integrated during the processing of documents using the ghelp scheme. This allows a malicious actor to gain unauthorized access to protected information and execute arbitrary code.
The vulnerability of the Yelp review system lies in the inclusion of functions from an unreliable and uncontrolled area during the processing of documents using the ghelp scheme. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information and...
CVE-2025-29820
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review...
CVE-2025-29801
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 17:46:43+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10970...
CVE-2025-27749
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-09 07:18:23+00:00| seen| https://poliverso.org/objects/0477a01e-45bed739-4cf70d274d3babdb 2025-04-10 11:32:21+00:00| seen|...
CVE-2025-26672
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:47:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10978...
CVE-2025-26676
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:47:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10985...
CVE-2025-26675
creationtimestamp| type| source ---|---|--- 2025-04-08 16:14:25+00:00| seen| https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review 2025-04-08 19:47:21+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10984...
CVE-2025-32018
Cursor is an AI-codeditor. Versions 0.45.0β0.48.6 contain a regression that broadens the Cursor Agentβs file-modification permissions, allowing, under deliberate prompting (user or crafted context), automatic writes to files outside the opened workspace. The vulnerability can manifest when the ag...
Year in Review: In conversation with the report's authors
π₯ Talos Year in Review 2024: Part 1 & 2 - Watch Now! Another year, another mountain of malicious telemetry to sift through. I spoke with a few of Talos' Year in Review authors, freshly out of the sandbox, to discuss the how's and why's of our biggest findings. π Part 1: The major theme of 2024, t...
CVE-2025-3328
creationtimestamp| type| source ---|---|--- 2025-04-06 06:16:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114289553732068500 2025-04-07 00:47:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/10648 2025-04-07 03:07:29+00:00| seen|...
CGA-X2JX-JQQ9-RPF4
Bulletin has no description...
One mighty fine-looking report
Welcome to this week's edition of the Threat Source newsletter. They say art is subjective, but have you ever seen a well-formatted bar chart? Van Gogh had Starry Night , but Talos' 2024 Year in Review available now! has color-coded data with perfect labels. True beauty. If you haven't yet had a...
CVE-2025-31836
Missing Authorization vulnerability in matthewrubin Review Manager review-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Review Manager: from n/a through = 2.6.0...
GHSA-28GR-56HR-PRP6 Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...
Grafana Tempo Operator Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This flaw allows a user with full access to their namespace to extract the ServiceAccount token and use it to submit TokenReview...
Incorrect Default Permissions
Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the validateMultitenancy function, invoked when creating a ServiceAccount, ClusterRole, or ClusterRoleBinding during a TempoStack or TempoMonolithic instance deployment. A user with full access to their...
CVE-2025-3072
creationtimestamp| type| source ---|---|--- 2025-04-02 03:01:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3llsfizn7in2h 2025-04-02 04:07:02+00:00| seen| https://t.me/cvedetector/21834 2025-04-08 16:14:25+00:00| seen|...