CVE-2025-6639 Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutorassignmentsubmit...

CVE-2025-6680

CVE-2025-6680 Tutor LMS (WordPress): Authenticated users with tutor-level+ access can view sensitive information by exposing assignments from courses they don’t teach. Affects Tutor LMS versions up to 3.8.3. Public advisories indicate remediation by upgrading to 3.8.4 or later; some sources also ...

CVE-2025-11760 eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure

The eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams plugin for WordPress is vulnerable to exposure of sensitive information in all versions up to, and including, 1.5.6. This is due to the plugin exposing Zoom SDK secret keys in client-side JavaScript within the meeting vie...

PT-2025-43711

Name of the Vulnerable Software and Affected Versions Tutor LMS Pro versions prior to 3.8.4 Description The Tutor LMS Pro plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This is due to a lack of proper validation on a user-controlled key when handling assignment...

CVE-2025-6639: Improper Authorization

The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.8.3 due to missing validation on a user controlled key when viewing and editing assignments through the tutorassignmentsubmit...

EUVD-2025-35849

Improper handling of DNS over TCP in Simple DNS Plus v9 allows a remote attacker with querying access to the DNS server to cause the server to return request payloads from other clients. This happens when the TCP length prefix is malformed len differs from actual packet len, and due to a...

The Cybersecurity Perception Gap: Why Executives and Practitioners See Risk Differently

Does your organization suffer from a cybersecurity perception gap? Findings from the Bitdefender 2025 Cybersecurity Assessment suggest the answer is probably "yes" — and many leaders may not even realize it. This disconnect matters. Small differences in perception today can evolve into major blin...

CVE-2025-60859

Cross Site Scripting XSS vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted cid parameter in bbs/viewcomment.php...

CVE-2025-60859

Cross Site Scripting XSS vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted cid parameter in bbs/viewcomment.php...

CVE-2025-22174

Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view portfolio rooms without the required permission...

EUVD-2025-35667

Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information...

CVE-2025-62400

Moodle (CMS) is affected by CVE-2025-62400: hidden-group names can be exposed to users who can create calendar events but cannot view hidden groups, risking disclosure of private/restricted group information. Connected advisories indicate Fedora NSS/Nessus entries reference this CVE and note vuln...

CVE-2025-60859

Cross Site Scripting XSS vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted cid parameter in bbs/viewcomment.php...

Moodle security vulnerabilities

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that originates from exposing hidden group names to users with the Create Calendar...

CVE-2025-60859

Cross Site Scripting XSS vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted cid parameter in bbs/viewcomment.php...

PT-2025-43494

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A logic error in multiple functions of KeyguardViewMediator.java allows for the bypass of lockdown mode when screen pinning is active. This issue can lead to local information disclosure...

Hitachi Ops Center Analyzer Data Compromise

The vulnerability of the Detail View component of the Hitachi Ops Center Analyzer software for data analysis and processing is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker operating remotely to compromise the integrity of the protect...

PT-2025-43489

Name of the Vulnerable Software and Affected Versions KeyguardViewMediator.java affected versions not specified Description A logic error in multiple functions within KeyguardViewMediator.java may allow a lockscreen bypass. This could result in local escalation of privilege without requiring...

PT-2025-51657

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.15.0-rc5-CI DRM 16515-gca0305cadc2d+ Description The Linux kernel contains a flaw in the drm/i915 subsystem related to lock inversion when pinning to GGTT on Cherry View CHV and Broxton BXT processors with...

PT-2025-43486

Name of the Vulnerable Software and Affected Versions KeyguardViewMediator affected versions not specified Description A logic error exists in the exitKeyguardAndFinishSurfaceBehindRemoteAnimation function within KeyguardViewMediator.java. This could allow a lockscreen bypass, potentially leading...