PT-2025-21730 · Elementor · Qi Addons For Elementor

Name of the Vulnerable Software and Affected Versions: X Addons for Elementor versions 1.0.0 through 1.0.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker ca...

PT-2025-21668 · Wishlist · Wishlist

Name of the Vulnerable Software and Affected Versions: Wishlist versions 2.1.0 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured access control security levels. Recommendations: For versions 2.1.0 and...

PT-2025-21719 · Unknown · Broadstreet

Name of the Vulnerable Software and Affected Versions: Broadstreet versions through 1.51.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For versions throug...

PT-2025-21721 · Unknown · Validatecertify

Name of the Vulnerable Software and Affected Versions: ValidateCertify versions 1.6.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

CVE-2025-22848

Improper conditions check for some Edge Orchestrator software for IntelR Tiber™ Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access...

CVE-2024-6335

creationtimestamp| type| source ---|---|--- 2025-05-15 20:37:15+00:00| seen| https://bsky.app/profile/potato.software/post/3lpaekssgag2f...

CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS

The MailPoet WordPress plugin before 5.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

GO-2025-3687 Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon

Babylon Integer Overflow in Distribution Module CumulativeRewardRatio Calculation Leading to Chain Halt in github.com/babylonlabs-io/babylon...

GO-2025-3672 goshs route not protected, allows command execution in github.com/patrickhener/goshs

goshs route not protected, allows command execution in github.com/patrickhener/goshs...

GO-2025-3686 Babylon Finality Provider `MsgCommitPubRandList` replay attack in github.com/babylonlabs-io/babylon

Babylon Finality Provider MsgCommitPubRandList replay attack in github.com/babylonlabs-io/babylon...

GO-2025-3683 Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf

Vulnerable to CSRF due to non-functional same-origin request checks in github.com/justinas/nosurf...

Mattermost Fails to Verify User's Permissions When Accessing Groups

Mattermost versions 10.5.x = 10.5.2, 9.11.x = 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows an attacker to view group information via an API request...

GHSA-M32F-FJW2-37V3 Bullfrog's DNS over TCP bypasses domain filtering

Summary Using tcp breaks blocking and allows DNS exfiltration. PoC name: test on: push: branches: - "" jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses:...

GHSA-QGWX-RFFP-6CX9 Mattermost Fails to Lockout LDAP Users After Repeated Login Failures

Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost...

CVE-2025-27524 Weak encryption vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager

Weak encryption vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06...

BELL-CVE-2025-24495

Bulletin has no description...

BELL-CVE-2023-53146

Bulletin has no description...

BELL-CVE-2024-45332

Bulletin has no description...

BELL-CVE-2025-20012

Bulletin has no description...

MAL-2025-3824 Malicious code in custom-social-connections (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63d17fbe69636024ad8599ea6675d12b5c1473dcee490a3f63f3bc80a0ad7f60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...