973225 matches found
15,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Dokan Pro WordPress Plugin
📢 Calling all Vulnerability Researchers and Bug Bounty Hunters!📢 🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per...
Dynatrace: OneAgent Unprivileged NTLM User Coercion
Vulnerability description not provided...
PT-2025-34520 · Undefined · Undefined
Apple released another CVE: CVE-2025-43280 •Impact: Processing web content may lead to arbitrary code execution •Description: The issue was resolved by not loading remote images ios applesecurity ios18 bugbountytip apple bugbounty applebugbounty...
curl: Missing Security Headers
Missing Security Headers Low Target: https://curl.se/ OWASP Mapping: A05 Misconfiguration / A02 Crypto Vulnerability ID: sec-headers-0f70ef5bcb Description A Missing Security Headers issue was discovered. This may allow an attacker to exploit the application. Proof of Concept Using cURL bash curl...
Wordfence Bug Bounty Program Monthly Report – July 2025
Last month in July 2025, the Wordfence Bug Bounty Program received 325 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence...
CVE-2025-34158
Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 11, 2025 to August 17, 2025)
Calling all Vulnerability Researchers and Bug Bounty Hunters! Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our 'High Threat' list in software with fewer than 5 million active installs. Bounties up to $31,200 per...
CVE-2025-34158
Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...
CVE-2025-34158
Summary: Plex Media Server (PMS) versions 1.41.7.x–1.42.0.x (before 1.42.1) are affected by token/credential disclosure through account and API surfaces, per CVE-2025-34158. Connected documents extend the impact to multiple PMS versions, noting PMS
curl: curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor
Summary: When using curl with a SOCKS5 proxy e.g. Tor on 127.0.0.1:9050, glibc getaddrinfo performs direct UDP connect probes to the target’s IP:443. These syscalls bypass the proxy and expose the user’s route to the destination, breaking anonymity expectations. The IPs I got in my case:...
Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner
Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner...
WakaTime: Invalid
Summary: While testing the OAuth implementation on your platform, I discovered a critical vulnerability that allows a malicious attacker to take over any victim’s account and maintain persistent access even if the victim later verifies their email or changes their password. This issue arises...
curl: WebSocket Fragmentation DoS on Curl Client
Summary A malicious WebSocket server can send a fragmented message FIN=0 followed by a flood of continuation frames, causing the client curl to continuously allocate memory while waiting for message completion. This can result in high memory usage and potential crash OOM, representing a...
Node.js: CWE-195 in ExternalMemoryAccounter::Increase()
Summary: V8's ExternalMemoryAccounter::Increase expects an unsigned sizet argument, but a signed ssizet which in some cases results in garbage collection to happen during garbage collection. Here's a simplified version of what happens full backtrace has been attached in the issue:...
curl: ## Title Heap Use-After-Free Vulnerability in `curl` Leading to Potential Code Execution
Summary A Use-After-Free UAF vulnerability was discovered in curl at curltrc.c:195. When processing specially crafted input, the code accesses memory after it has already been freed. This can result in undefined behavior, leading to a denial of service crash and potentially enabling information...
MAL-2025-6915 Malicious code in bug-bounty-hunter (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6914 Malicious code in bug-bounty (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in bug-bounty (npm)
The package communicates with a domain associated with malicious activity...