Linux Distros Unpatched Vulnerability : CVE-2019-9802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a Sandbox content process is compromised, it can initiate an FTP download which will then use a child process to render the downloaded data. The downloaded...

The vulnerability of the Notes component in operating systems iPadOS and macOS, which allows a hacker to disclose sensitive information

The vulnerability of the Notes component in iPadOS and macOS systems relates to the disclosure of information through registration files. Exploiting this vulnerability can allow attackers to disclose protected information...

WordPress BitFire plugin <= 4.5 - Unauthenticated Information Exposure vulnerability

Unauthenticated Information Exposure vulnerability discovered by Aurélien BOURDOIS Elymaro in WordPress Plugin BitFire Security versions = 4.5...

CVE-2025-41659

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted...

CVE-2025-41659

CVE-2025-41659 concerns the CODESYS Control runtime system where a low-privileged, remote attacker can access the PKI folder to read/write certificates and keys. The described outcome is extraction of sensitive data or the ability to trust certificates, with all services remaining available but c...

CVE-2025-41659 CODESYS Control PKI Exposure Enables Remote Certificate Access

A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted...

Tera Insights tiCrypt 安全漏洞

Tera Insights tiCrypt is a private cloud secure computing platform from Tera Insights, Inc. in the United States. A security vulnerability exists in versions of Tera Insights tiCrypt prior to 2025-07-17 that stems from tiaudit allowing unauthenticated REST API requests to disclose sensitive...

Advisory ROSA-SA-2025-2916

software: xwayland 24.1.6 WASP: ROSA-CHROME unaffected versions = xwayland-24.1.6-1 affected versions xwayland-24.1.6-1 CVE-ID: CVE-2025-26594 BDU-ID: 2025-04129 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the Wayland protocol implementation for X.Org XWayland, an implementation of the X Windo...

CVE-2025-45768

A flaw was found in pyjwt. The library uses weak encryption, allowing an attacker to potentially decrypt sensitive data. A network-based attacker can exploit this vulnerability without authentication, possibly resulting in a denial of service or data exposure. This weakness stems from the use of...

CVE-2025-24854

A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.3 or later...

CVE-2025-37110

A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information...

CVE-2025-6722 BitFire <= 4.5 - Unauthenticated Information Exposure

The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire directory that automatically gets created and stores potentially sensitive files without any access...

CVE-2025-54792 LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle MitM vulnerability in the software's discovery protocol allows an unauthenticated attacke...

CVE-2025-54792 LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle MitM vulnerability in the software's discovery protocol allows an unauthenticated attacke...

CVE-2025-50870

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...

CVE-2025-2824

IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the...

GHSA-RRMM-WQ7Q-H4V5 OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape

Impact OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types ip, geopoint, geoshape, xypoint, xyshape. While the content of these fields is properly redacted in the source document returned by search operations, the original unredacted values remain...

io.quarkus/quarkus-vertx: Quarkus potential data leak

A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be...

WordPress GiveWP plugin < 4.6.1 - PII Sensitive Data Exposure vulnerability

PII Sensitive Data Exposure vulnerability discovered by kxkv in WordPress Plugin GiveWP versions 4.6.1...

CVE-2025-4523

CVE-2025-4523 affects the WordPress plugin “IDonate – Blood Donation, Request And Donor Management System”. The vulnerability arises from a missing capability check in the admin_donor_profile_view() function, making it possible for authenticated users with Subscriber-level access and above to exp...