Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Cybercriminal groups peddling sophisticated phishing kits that convert stolen card data into mobile wallets have recently shifted their focus to targeting customers of brokerage services, new research shows. Undeterred by security controls at these trading platforms that block users from wiring...

CVE-2025-7507

The elink – Embed Content plugin for WordPress is vulnerable to Malicious Redirect in all versions up to, and including, 1.1.0. This is due to the plugin not restricting URLS that can be supplied through the elink shortcode. This makes it possible for authenticated attackers, with Contributor-lev...

CVE-2025-9004 mtons mblog password excessive authentication

A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. T...

CVE-2025-50861

The CVE-2025-50861 entry affects the Lotus Cars Android App (com.lotus.carsdomestic.intl) version 1.2.8, where the exported component PushDeepLinkActivity is accessible without authentication via ADB or malicious apps. This could allow unintended access to application internals and may lead to de...

Altus Cars Lotus Cars Android app 安全漏洞

Altus Cars Lotus Cars Android app is a mobile app from Altus Cars UK that provides vehicle remote control and connectivity services. A security vulnerability exists in Altus Cars Lotus Cars Android app version 1.2.8, which originates from unauthenticated access to a component and could lead to a...

FreeBSD : PostgreSQL -- vulnerabilities (fc048b51-7909-11f0-90a2-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fc048b51-7909-11f0-90a2-6cc21735f730 advisory. PostgreSQL project reports: Tighten security checks in planner estimation functions. Prevent...

CVE-2025-50861

The Lotus Cars Android app com.lotus.carsdomestic.intl 1.2.8 contains an exported component, PushDeepLinkActivity, which is accessible without authentication via ADB or malicious apps. This poses a risk of unintended access to application internals and can cause denial of service or logic abuse...

CVE-2025-55194 Part-DB Persistent Denial of Service via Uncaught Exception from Misleading File Extension in Avatar Upload

Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension e.g., .jpg.txt, resulting in a persistent 500 Internal Server Error when attempting to view or edit that...

CVE-2025-40753

Affected devices POWER METER SICAM Q100 (versions 2.60–2.61) and Q200 (versions 2.70–2.79) export the SMTP password in plain text within the Configuration File. This local-authenticated exposure allows an attacker with access to the device to extract credentials and abuse the configured SMTP serv...

CVE-2025-40752

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configure...

CVE-2025-41686

CVE-2025-41686 describes a local privilege escalation in which a low-privileged attacker can exploit improper permissions on nssm.exe to gain administrative access. The CVSS v3.1 vector is LOCAL, with LOW privileges required, no user interaction, and a base score of 7.8 (HIGH). Affected component...

Linux Distros Unpatched Vulnerability : CVE-2019-19709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MediaWiki through 1.33.1 allows attackers to bypass the Titleblacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable...

Siemens SICAM Q100/Q200

SUMMARY SICAM Q100 and Q200 devices are affected by two information disclosure vulnerabilities that could allow an authenticated local attacker to extract the SMTP account password and use the configured SMTP service for arbitrary purposes. Siemens has released new versions for the affected...

Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)

Summary NATS-Server is used by Astronomer with IBM as part of the messaging functionality. Vulnerability Details CVEID:CVE-2025-30215 DESCRIPTION: NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27...

Linux Distros Unpatched Vulnerability : CVE-2021-44856

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via...

CVE-2025-8795

A vulnerability, which was classified as critical, was found in LitmusChaos Litmus up to 3.19.0. This affects an unknown part of the file /auth/login. The manipulation of the argument projectID leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-54997

OpenBao (OpenBao) v2.3.1 and earlier are vulnerable to code execution and unintended network access due to privileged API operators bypassing restrictions via the audit subsystem by manipulating log prefixes. The root cause is an abuse of the audit/log-prefix handling in privileged operators, ena...

oak 安全漏洞

oak is a middleware framework from oak open source. A security vulnerability exists in oak version 17.1.5 and earlier, which stems from the fact that a specially crafted value in the x-forwarded-proto or x-forwarded-for header may cause a degradation in server performance...

PT-2025-32439 · Linlinjava · Litemall

Name of the Vulnerable Software and Affected Versions: linlinjava litemall versions up to 1.8.0 Description: A critical issue exists in linlinjava litemall up to version 1.8.0 related to path traversal. The delete function within the File Handler component, located at the /admin/storage/delete AP...

CVE-2025-5095

Burk Technology ARC Solo is affected by CVE-2025-5095: the device’s password-change endpoint accepts requests without valid credentials due to missing authentication/session validation, enabling an attacker to take control of the device. Reports note high-impact outcomes (full compromise risk) wi...