CVE-2025-5818 Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery

The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fipgetimageoptions function. This makes it possible for authenticated attackers, with administrator-level access and abov...

The vulnerability of Trend Micro Worry-Free Business Security (WFBS) and Worry-Free Business Security Services (WFBSS) lies in the lack of authentication for a critical function, allowing attackers to gain full control over the application.

The vulnerability of Trend Micro Worry-Free Business Security WFBS and Worry-Free Business Security Services WFBSS lies in the lack of authentication for a critical function. Exploiting this vulnerability can allow an attacker, operating remotely, to gain full control over the application...

Cisco Confirms Active Exploits Targeting ISE Flaws Enabling Unauthenticated Root Access

Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine ISE and ISE Passive Identity Connector ISE-PIC to acknowledge active exploitation. "In July 2025, the Cisco PSIRT Product Security Incident Response Team, became aware of attempted...

This Week in Spring - July 22nd, 2025

Hi, Spring fans! It's almost SpringOne time!! AAAAH it's all moving so quickly! I can hardly stand it. SpringOne's next month, in lovely Las Vegas, and I'll be there. Will you? Have you registered? We'll be looking at the impending Spring Boot 4.0 and Spring Framework 7.0 releases! It's going to ...

AUTOPSY: a Framework for Tackling Privacy Challenges in the Automotive Industry

With the General Data Protection Regulation GDPR in place, all domains have to ensure compliance with privacy legislation. However, compliance does not necessarily result in a privacy-friendly system as for example getting users' consent to process their data does not improve the...

CVE-2025-54122 Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

CVE-2025-54122 Manager-io/Manager allows unauthenticated full read server-side request forgery in "proxy" endpoint

Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery SSRF vulnerability has been identified in the proxy handler component of both manager Desktop and Server edition versions up to and including 25.7.18.2519. This vulnerability allows an...

CVE-2025-54121

CVE-2025-54121 affects Starlette (Python, ASGI). In versions 0.47.1 and older, multipart form parsing of large files can cause the main event loop to stall while rolling the file to disk, because UploadFile incorrectly checks file-in-memory status and whether additional bytes trigger a rollover. ...

China-Linked Hackers Launch Targeted Espionage Campaign on African IT Infrastructure

The China-linked cyber espionage group tracked as APT41 has been attributed to a new campaign targeting government IT services in the African region. "The attackers used hardcoded names of internal services, IP addresses, and proxy servers embedded within their malware," Kaspersky researchers Den...

Why Observability Tools Tend to Fail at Scale

Observability is no longer just about catching errors or checking if a server is up. In modern distributed systems, it’s about understanding behavior across dozens, if not thousands, of services, all running in different environments and generating massive amounts of data...

openjdk: Glyph out-of-memory access and crash (Oracle CPU 2025-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0.1;...

VulnCheck KEV: CVE-2025-20337

A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root. The attacker does not require any valid credentials to exploit this vulnerability. This vulnerability is due to...

Unspecified Vulnerability in Oracle MySQL Server (CNVD-2025-17160)

Oracle MySQL Server is a relational database from Oracle Corporation. A security vulnerability exists in Oracle MySQL Server that originates from improper access control of the Components Services component and can be exploited by an attacker to cause a denial of service...

The vulnerability of the Cisco Identity Services Engine (ISE) policy management platform and the Cisco ISE Passive Identity Connector (ISE-PIC) virtual authentication data collection device exists due to the lack of measures to neutralize specific elements, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the Cisco Identity Services Engine ISE policy management platform and the Cisco ISE Passive Identity Connector ISE-PIC virtual authentication data collection device exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a...

The vulnerability of the IP Access Restriction function of the Cisco Identity Services Engine (ISE) management interface and the Cisco ISE Passive Identity Connector (ISE-PIC) virtual authentication data collection device allows a perpetrator to circumvent existing IP access restrictions.

The vulnerability of the IP Access Restriction function of the Cisco Identity Services Engine ISE and the Cisco ISE Passive Identity Connector ISE-PIC, a virtual device for collecting user authentication data, relates to bypassing authentication using data that is assumed to be unchangeable...

At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds

Of those, more than 200 appear to have had outages of services related to patient care following CrowdStrike’s disastrous crash, researchers have revealed...

Improper Privilege Management

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Privilege Management via improper privilege enforcement in the Fine-Grained Admin Permissions proces...

Critical NVIDIA Container Toolkit Flaw Allows Privilege Escalation on AI Cloud Services

Cybersecurity researchers have disclosed a critical container escape vulnerability in the NVIDIA Container Toolkit that could pose a severe threat to managed AI cloud services. The vulnerability, tracked as CVE-2025-23266, carries a CVSS score of 9.0 out of 10.0. It has been codenamed NVIDIAScape...

Vulnerabilities fixed in Citrix NetScaler ADC and NetScaler Gateway

Citrix has fixed vulnerabilities in NetScaler ADC and NetScaler Gateway. The vulnerability with reference CVE-2025-5777 involves an Out-of-Bounds Read. This vulnerability arises from insufficient input validation in systems configured as Gateway services. These include VPN virtual servers, ICA...

CVE-2025-30756

Vulnerability in Oracle REST Data Services component: General. The supported version that is affected is 24.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from...