GHSA-J3Q6-Q5PC-V5WF

creationtimestamp| type| source ---|---|--- 2025-12-03 18:32:55+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115657066080526795...

CVE-2025-64763 Envoy forwards early CONNECT data in TCP proxy mode

Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, when Envoy is configured in TCP proxy mode to handle CONNECT requests, it accepts client data before issuing a 2xx response and forwards that data to the upstream TCP connection. If a forwardi...

GHSA-46GC-MWH4-CC5R

creationtimestamp| type| source ---|---|--- 2025-12-03 18:06:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115656962660505423...

GHSA-PRHC-CHFW-32JG

creationtimestamp| type| source ---|---|--- 2025-12-03 17:13:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115656755616258132...

GHSA-CJ9G-V5MQ-QRJM

creationtimestamp| type| source ---|---|--- 2025-12-03 17:05:36+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115656722756256466...

CVE-2025-37911

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2025-40158

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/...

CVE-2023-53403

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2024-26747

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2024-35871

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2024-26733

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2022-49650

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

CVE-2024-26756

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-06-29 16:19:38+00:00| seen|...

CVE-2022-49121

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

EUVD-2025-200726

The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the processstatusunlink function in all versions up to, and including, 2.3.8. This makes it possible for unauthenticated...

CVE-2025-64298

creationtimestamp| type| source ---|---|--- 2025-12-02 23:24:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m723milxw72n 2025-12-03 03:10:07+00:00| seen| https://bsky.app/profile/blackwiremedia.bsky.social/post/3m72iad66xm2b...

CVE-2025-57850

creationtimestamp| type| source ---|---|--- 2025-12-02 19:16:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651575723555326 2025-12-02 21:35:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6zvkp3lak2k...

GHSA-9H52-P55H-VW2F

creationtimestamp| type| source ---|---|--- 2025-12-02 19:07:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651541601478240...

GHSA-C7RR-2H93-7GJF

creationtimestamp| type| source ---|---|--- 2025-12-02 18:09:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115651311349715908...

“Sleeper” browser extensions woke up as spyware on 4 million devices

Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed on roughly 4.3 million Chrome and Edge users’ devices suddenly went rogue. Now they can track what you browse and run malicious code insi...