PT-2025-43553

Name of the Vulnerable Software and Affected Versions UniFi Access Application versions 3.3.22 through 3.4.31 Description A misconfiguration in the UniFi Access application exposes a management API without proper authentication. An attacker with access to the management network could exploit this...

Prompt injection in Opera Neon: Rapid response through responsible disclosure

Security Prompt injection in Opera Neon: Rapid response through responsible disclosure Share October 23rd, 2025 Hi Opera users, This week, we were able to address a real-world security scenario on Opera Neon thanks to the work of a security researcher team. The researchers reached out to us throu...

CVE-2025-11957

creationtimestamp| type| source ---|---|--- 2025-10-22 18:11:42+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115419165525961928 2025-10-22 20:21:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3sobglst523...

Top security researcher shares their bug bounty process

As we wrap Cybersecurity Awareness Month, the GitHub Bug Bounty team is excited to spotlight another top performing security researcher who participates in the GitHub Security Bug Bounty Program, Andr e Storfjord Kristiansen! GitHub is dedicated to maintaining the security and reliability of the...

GHSA-G9QW-G6RV-3889

creationtimestamp| type| source ---|---|--- 2025-10-20 20:38:54+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115408419667360961...

CVE-2025-8051

creationtimestamp| type| source ---|---|--- 2025-10-20 20:38:54+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115408419667958692 2025-10-20 22:46:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3nvgmtjsh2m...

CVE-2025-62527

creationtimestamp| type| source ---|---|--- 2025-10-20 20:38:53+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115408419666821301...

CVE-2025-62697

creationtimestamp| type| source ---|---|--- 2025-10-20 20:38:53+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115408419667030752 2025-10-20 22:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3nt74uyw72o...

CVE-2025-8049

creationtimestamp| type| source ---|---|--- 2025-10-20 20:38:53+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115408419667508056 2025-10-20 22:50:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3nvocph6y2i...

CVE-2019-17589

creationtimestamp| type| source ---|---|--- 2025-10-18 08:42:15+00:00| seen| https://infosec.exchange/users/BugBountyShorts/statuses/115394277178940986...

Wordfence Bug Bounty Program Monthly Report – September 2025

Last month in September 2025, the Wordfence Bug Bounty Program received 374 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the...

Apple’s Bug Bounty Program

Apple is now offering a $2M bounty for a zero-click exploit. According to the Apple website: Today we’re announcing the next major chapter for Apple Security Bounty, featuring the industry’s highest rewards, expanded research categories, and a flag system for researchers to objectively demonstrat...

4,000,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Slider Revolution WordPress Plugin

Calling all Vulnerability Researchers and Bug Bounty Hunters! Operation: Maximum Impact Challenge ! Now through November 10, 2025, earn 2X bounty rewards forall in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 pe...

GHSA-XC79-566C-J4QX Parallax is vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be made to consume very large amounts of memory when handling specially crafted p2p messages sent from an attacker node. In order to carry out the attack, the attacker establishes a peer connections to the victim, and sends a malicious GetBlockHeadersRequest message...

lemlist: Unauthorized Password Reset Allows Account Takeover Across Tenant Boundaries

An authorization issue was discovered in the application that allowed a tenant admin to change the password of another user within the same tenant, including invited agency accounts. The victim had to first accept the invitation before the attacker could proceed. The issue could allow unintended...

Apple Announces $2 Million Bug Bounty Reward for the Most Dangerous Exploits

With the mercenary spyware industry booming, Apple VP Ivan Krstić tells WIRED that the company is also offering bonuses that could bring the max total reward for iPhone exploits to $5 million...

CVE-2025-42701

A race condition exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility...

CrowdStrike Falcon Sensor 7.16.x < 7.16.18637 / 7.24.19608 / 7.25.19706 / 7.26.19809 / 7.26.19811 / 7.27.19907 / 7.28.20006 Multiple Vulnerabilities

The version of CrowdStrike Falcon Sensor installed on the remote host is prior to 7.16.18637, 7.24.19608, 7.25.19707, 7.26.19813, 7.27.19909, or 7.28.20008. It is, therefore, affected by multiple vulnerabilities as referenced in the vendor advisory. - A race condition exists in the Falcon sensor...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 29, 2025 to October 5, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Operation: Maximum Impact Challenge ! Now through November 10, 2025, earn 2X bounty rewards forall in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 pe...

Mars: Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint

A vulnerability was identified that allowed unauthorized access to personally identifiable information through an unprotected API endpoint. The vulnerability exposed user email addresses and telephone numbers. The issue was classified under CWE-312 with a CVSS score of 6.1. The vulnerability was...