CVE-2025-53092 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper...

CVE-2025-53092 Strapi core vulnerable to sensitive data exposure via CORS misconfiguration

Strapi is an open source headless content management system. Strapi versions prior to 5.20.0 contain a CORS misconfiguration vulnerability in default installations. By default, Strapi reflects the value of the Origin header back in the Access-Control-Allow-Origin response header without proper...

CVE-2025-53092

Strapi core (open-source headless CMS) contains a CORS misconfiguration in default installations prior to version 5.20.0: the Origin header is reflected back in Access-Control-Allow-Origin without proper validation or whitelisting, enabling an attacker-controlled site to send credentialed request...

One Republican Now Controls a Huge Chunk of US Election Infrastructure

Former GOP operative Scott Leiendecker just bought Dominion Voting Systems, giving him ownership of voting systems used in 27 states. Election experts don't know what to think...

WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Social proof testimonials and reviews by Repuso versions = 5.29...

CVE-2025-3930 Lack of JWT Expiration after Log Out in Strapi

Strapi uses JSON Web Tokens JWT for authentication. After logout or account deactivation, the JWT is not invalidated, which allows an attacker who has stolen or intercepted the token to freely reuse it until its expiration date which is set to 30 days by default, but can be changed. The existence...

USN-7825-1 mupdf vulnerabilities

It was discovered that MuPDF incorrectly managed memory, resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. CVE-2018-1000036 It was discovered that MuPDF could enter an infinite loop when parsing certain P...

CVE-2025-62580 ASDA-Soft Stack-based Buffer Overflow Vulnerability

ASDA-Soft Stack-based Buffer Overflow Vulnerability...

Congratulations to the top MSRC 2025 Q3 security researchers!

Congratulations to all the researchers recognized in this quarter’sMicrosoft Researcher Recognition Programleaderboard! Thank you to everyone for your hard work and continued partnership to secure customers...

Exploit for CVE-2025-11001

CVE-2025-1...

K000156597: BIG-IP APM portal access vulnerability CVE-2025-61960

Security Advisory Description When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel TMM to terminate. CVE-2025-61960 Impact Traffic is disrupted while the TMM process restarts. This vulnerability allo...

CVE-2025-39969

In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40EVFSTATEACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources. Use...

CVE-2025-48984

creationtimestamp| type| source ---|---|--- 2025-10-15 06:49:12+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m37nmxajwl2a 2025-10-15 14:05:45+00:00| seen| https://vulnerability.circl.lu/bundle/cafe2e2f-6c80-497d-93e2-f209820608e6 2025-10-15 20:50:46+00:00| seen|...

EUVD-2025-34504

Not used...

CVE-2025-61804 Animate | Heap-based Buffer Overflow (CWE-122)

Animate versions 23.0.13, 24.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

Toward Cybersecurity-Expert Small Language Models

Large language models LLMs are transforming everyday applications, yet deployment in cybersecurity lags due to a lack of high-quality, domain-specific models and training datasets. To address this gap, we present CyberPal 2.0, a family of cybersecurity-expert small language models SLMs ranging fr...

Bold Workplanner Insecure Direct Object Reference Vulnerability

Bold Workplanner is an enterprise software for human resource management from the Spanish company Bold Workplanner. An insecure direct object reference vulnerability exists in Bold Workplanner versions prior to 2.5.25, which stems from a lack of sufficient validation of user input, and can be...

PT-2025-42219

Name of the Vulnerable Software and Affected Versions SmartBI versions 8 through 10 Description SmartBI versions 8, 9, and 10 have an unrestricted file upload issue in the RMIServlet request handling logic. Attackers can send crafted requests to perform sensitive operations or execute code on the...

HTTP Request Smuggling

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of chunked HTTP requests. An attacker can bypass security restrictions and potentially access or manipulate sensitive data by sending specially crafted HTTP requests that exploit...