CVE-2025-49005

creationtimestamp| type| source ---|---|--- 2025-07-03 23:12:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3u3a3mqo2a 2025-07-04 09:00:05+00:00| seen| https://bsky.app/profile/rss.y-u-e.workers.dev/post/3lt4uw734il2l 2025-07-04 17:14:04+00:00| seen|...

CVE-2025-6071

creationtimestamp| type| source ---|---|--- 2025-07-03 19:38:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lt3i4pxddn2p 2025-07-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-196-02 2025-08-06 13:54:19+00:00| seen|...

CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455 CVE-2025-27455

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of...

CVE-2025-27455

CVE-2025-27455 is linked to a clickjacking vulnerability in Endress+Hauser MEAC300-FNADE4 web interface (end-user frame embedding allowed). Connected sources confirm the affected product and vulnerability class but do not provide a confirmed patch/version fix; one PT-SEC source notes no available...

The vulnerability of the http-foundation component of the Symfony software development and web application management platform allows attackers to access confidential data.

The vulnerability of the http-foundation component of the Symfony software development and web application management platform is related to the use of open redirection. Exploiting this vulnerability could allow an attacker to gain access to confidential data...

CVE-2025-53106

creationtimestamp| type| source ---|---|--- 2025-07-02 04:31:31+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lsxey3vfhe2z 2025-07-02 14:54:26+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114784211147922979 2025-07-02 17:16:10+00:00| seen|...

Elastic WAF: Reshaping Application Security for DevOps and Hybrid Environments

We recently discussed Imperva’s vision for the future of application security, where we also covered the Imperva Security Engine. This innovative application security framework is powering up the next generation of Imperva solutions, the first of which is Imperva Elastic WAF. This blog is the fir...

CVE-2024-46992

CVE-2024-46992 affects Electron versions 30.0.0-alpha.1 through 30.0.4, and 31.0.0-alpha.1 through 31.0.0-beta.1. The issue is an ASAR integrity bypass that applies only when embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled, and only if the app is launched from a writable...

PT-2025-27508 · Unknown · Industrialpi

Name of the Vulnerable Software and Affected Versions: IndustrialPI affected versions not specified Description: An unauthenticated remote attacker can bypass the login to the web application of the affected devices, making it possible to access and change all available settings of the...

CVE-2025-45081

Misconfigured settings in IITB SSO v1.1.0 allow attackers to access sensitive application data...

CVE-2025-4407

The CVE-2025-4407 entry concerns ABB Lite Panel Pro with an Insufficient Session Expiration flaw affecting versions up to and including 1.0.1. The issue, with adjacent network attack vector, low privileges required, and user interaction needed, could compromise confidentiality and integrity, unde...

CVE-2025-6773

creationtimestamp| type| source ---|---|--- 2025-06-27 19:52:02+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19779 2025-06-27 20:59:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsmju4fxyu23...

PT-2025-27224 · Unknown · Track Everything

Name of the Vulnerable Software and Affected Versions: Track Everything versions n/a through 2.0.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2025-27225 · Unknown · Resume Builder

Name of the Vulnerable Software and Affected Versions: My Resume Builder versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

WordPress ClipLink plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress ClipLink plugin, which arises from a web application that does not adequately validate that a request is comin...

Spring Framework 6.0.5 < 6.0.29 / 6.1.x < 6.1.21 / 6.2.x < 6.2.8 Reflected File Download (CVE-2025-41234)

The version of Spring Framework installed on the remote host is 6.0.5 prior to 6.0.29, 6.1.x prior to 6.1.21, or 6.2.x prior to 6.2.8. It is, therefore, affected by a reflected file download vulnerability: - In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application...

Discourse < 3.4.6 Information Disclosure Vulnerability

Discourse is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Amazon Linux 2 : aws-kinesis-agent (ALAS-2025-2898)

The version of aws-kinesis-agent installed on the remote host is prior to 2.0.12-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2898 advisory. Jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data...

CVE-2025-34039 Yonyou NC BeanShell Command Injection

A code injection vulnerability exists in Yonyou UFIDA NC v6.5 and prior due to the exposure of the BeanShell testing servlet bsh.servlet.BshServlet without proper access controls. The servlet allows unauthenticated remote attackers to execute arbitrary Java code via the bsh.script parameter. This...