CVE-2023-7239

The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the postid parameter in its wpdnupdatenote AJAX action. This allows users with a role of contributor and above to update notes created by other users...

CVE-2024-6584

The 'wpajaxboostproxyig' action allows administrators to make GET requests to arbitrary URLs...

CVE-2024-6809

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6159

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-47775

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue...

CVE-2025-4600

A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after ...

MAL-2025-3920 Malicious code in statewars (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3054b3bc016fb28cbd39ad6ff12e082819c4ded2b17560fa6a0d5e750c80f61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[NetScaler-AAA] The Radius action cannot be performed in nFactor auth

In nFactor auth, the Radius action is the second factor but cannot be performed. nFactor flow is simple and is like below: AAA vServer: DomainRadiusvS Login Schema: DualAuthSchema Authn Policy: DomainLDAPPol Expression: true Action: LDAPAct Next Factor if Success: RadiusPollable Login Schema:...

CVE-2024-6809

The Simple Video Directory WordPress plugin before 1.4.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-6159

The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2023-7239

The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the postid parameter in its wpdnupdatenote AJAX action. This allows users with a role of contributor and above to update notes created by other users...

CVE-2024-6809

The CVE-2024-6809 entry maps to the WordPress Simple Video Directory plugin (versions prior to 1.4.3) where a SQL injection is caused by failing to properly sanitize and escape a parameter used in a SQL statement via an unauthenticated AJAX action. Affected component: plugin code handling the AJA...

Breachforums Boss to Pay $700k in Healthcare Breach

In what experts are calling a novel legal outcome, the 22-year-old former administrator of the cybercrime community Breachforums will forfeit nearly $700,000 to settle a civil lawsuit from a health insurance company whose customer data was posted for sale on the forum in 2023. Conor Brian...

MAL-2025-3840 Malicious code in mozilla-protocol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c90ec3ba319513f7c6a1ea4cd67f7fc483bf2771087d2c78c1371a1613d17d97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3821 Malicious code in baby-electrona (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec384e55b0c31502cfa3a8ff82ee55f1991c43cd00c795f71d25165f25ac8490 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3805 Malicious code in @equis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7017af11f786172b41ddbe4efe5d6f38373a9146c8b1fca39e212ed6403f8720 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3856 Malicious code in spl-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86e0efcb779c43be336174a24f04614ab82be9f92a235feaf6e344d814bb2789 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-21479 · WordPress · Push Notification For Post/Buddypress

Name of the Vulnerable Software and Affected Versions: The Push Notification for Post and BuddyPress WordPress plugin versions prior to 1.9.4 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action...

CVE-2025-47775

Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue...

narayana: deadlock via multiple join requests sent to LRA Coordinator

A security issue was discovered in the LRA Coordinator component of Narayana. When Cancel is called in LRA, an execution time of approximately 2 seconds occurs. If Join is called with the same LRA ID within that timeframe, the application may crash or hang indefinitely, leading to a denial of...