CVE-2025-10176

The CVE-2025-10176 entry concerns The Hack Repair Guy's Plugin Archiver for WordPress, with ARBITRARY FILE DELETION in prepare_items across versions up to 2.0.4. The issue arises from insufficient file path validation, enabling authenticated users with Administrator-level access to delete arbitra...

PT-2025-37355

Name of the Vulnerable Software and Affected Versions: The Hack Repair Guy's Plugin Archiver plugin for WordPress versions up to and including 2.0.4 Description: The Plugin Archiver plugin for WordPress is susceptible to arbitrary file deletion due to inadequate file path validation within the...

WordPress plugin The Hack Repair Guy s Plugin Archiver Path Traversal Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exis...

PT-2025-37314

Name of the Vulnerable Software and Affected Versions dstack versions prior to 0.5.4 Description dstack is a software development kit SDK designed to simplify the deployment of containerized applications into trusted execution environments. In versions prior to 0.5.4, a malicious host can provide...

HTTP/2 Protocol DoS

The vulnerability of the HTTP/2 protocol implementation in software for protecting and managing application traffic, such as BIG-IP Next and its related software products like BIG-IP Next SPK, BIG-IP Next CNF, BIG-IP Next for Kubernetes, BIG-IP, and F5 Silverline, is related to unlimited resource...

Cisco Adaptive Security Appliances IKEv2 DoS

The vulnerability of the Internet Key Exchange Version 2 IKEv2 function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems is related to the absence of memory release after the effective lifespan. Exploitation of this vulnerability can allow a malicious actor ...

Cisco Adaptive Security Appliances IKEv2 DoS

The vulnerability of the Internet Key Exchange Version 2 IKEv2 function in Cisco Adaptive Security Appliance ASA and Cisco Firepower Threat Defense FTD systems relates to the execution of a cycle with an unavailable exit condition. Exploitation of this vulnerability could allow a malicious actor ...

Cisco Adaptive Security Appliances IKEv2 DoS

The vulnerability of the Internet Key Exchange Version 2 IKEv2 function in Cisco Adaptive Security Appliances ASA and Cisco Firepower Threat Defense FTD is related to a memory leak error during the processing of incoming IKEv2 packets. Exploiting this vulnerability can allow an attacker to cause...

Netty HTTP/2 DoS

The vulnerability of the HTTP/2 protocol implementation in the Netty network programming framework lies in the unlimited distribution of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2025-58761

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The realpmsimageproxy endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. The realpmsimageproxy i...

ALPINE-CVE-2025-58060

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in...

CVE-2025-58060 cups has Authentication bypass with AuthType Negotiate

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in...

curl: TOCTOU Race Condition in HTTP/2 Connection Reuse Leads to Certificate Validation Bypass

I've discovered a Time-of-Check to Time-of-Use TOCTOU vulnerability in how libcurl handles persistent HTTP/2 connections. During the initial handshake, libcurl correctly validates the server's certificate against the user-provided CA bundle. However, it then assumes this trust is permanent for th...

Moderate: Red Hat Security Advisory: httpd:2.4 security update

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

UBUNTU-CVE-2025-58364

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, an unsafe deserialization and validation of printer attributes causes null dereference in the libcups library. This is a remote DoS vulnerability available in local...

Security Bulletin: Uncontrolled Resource Consumption in Apache Commons Configuration 1.x When Loading Untrusted Configurations, affects watsonx.data

Summary Uncontrolled Resource Consumption vulnerability in Apache Commons Configuration 1.x. There are a number of issues in Apache Commons Configuration 1.x that allow excessive resource consumption when loading untrusted configurations or using unexpected usage patterns. The Apache Commons...

CVE-2025-8691

The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-8398

The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

MAL-2025-47051 Malicious code in @team-event/v2 (npm)

The package @team-event/v2 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc9d7a4f41e5d6a4af9a15c05d4e0023f5f141a75b5c62d116bb229a1ea7541d Any computer that has this package installed or running should be considered fully...

WordPress BeyondCart Connector plugin <= 3.0.1 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin BeyondCart Connector versions = 3.0.1...