WordPress Ninja Countdown plugin <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Countdown Deletion vulnerability discovered by Ivan Cese in WordPress Plugin Ninja Countdown versions = 1.5.0...

CVE-2025-43723

Dell PowerScale OneFS, versions prior to 9.10.1.3 and versions 9.11.0.0 through 9.12.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

EUVD-2025-48551

Malicious code in brokenswanz3n npm...

EUVD-2025-48553

Malicious code in brokenhalibutz3n npm...

MAL-2025-55422 Malicious code in broken_halibut_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0db0076668b0898fce54de799929c730fae205a5a8d0664a66db71a33b8cb79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Envira Photo Gallery plugin <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion vulnerability

Missing Authorization to Authenticated Contributor+ Gallery Conversion vulnerability discovered by Lucas Montes Nirox in WordPress Plugin Envira Photo Gallery versions = 1.11.0...

WordPress Flexible Refund and Return Order for WooCommerce plugin <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update vulnerability

Incorrect Authorization to Authenticated Contributor+ Refund Status Update vulnerability discovered by Powpy in WordPress Plugin Flexible Refund and Return Order for WooCommerce versions = 1.0.42...

WordPress EventPrime plugin <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation vulnerability

Missing Authorization to Authenticated Subscriber+ Booking Note Creation vulnerability discovered by Brian Mungai in WordPress Plugin EventPrime versions = 4.2.0.0...

WordPress Ovatheme Events Manager plugin <= 1.8.6 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by Foxyyy in WordPress Plugin Ovatheme Events Manager versions = 1.8.6...

WordPress Contact Form 7 AWeber Extension plugin <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset vulnerability

Missing Authorization to Authenticated Subscriber+ Log Reset vulnerability discovered by Legion Hunter in WordPress Plugin Contact Form 7 AWeber Extension versions = 0.1.42...

WordPress Download Manager plugin <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key vulnerability

Unauthenticated Cron Trigger due to Hardcoded Cron Key vulnerability discovered by Jack Pas Dark. - Black Lantern Security in WordPress Plugin Download Manager versions = 3.3.30...

WordPress WPFunnels plugin <= 3.6.2 - Unauthorized User Registration vulnerability

Unauthorized User Registration vulnerability discovered by Ahmed Rayen Ayari in WordPress Plugin WPFunnels versions = 3.6.2...

WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Seriously Simple Podcasting versions = 3.13.0...

WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.7 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Client Invoicing by Sprout Invoices versions = 20.8.7...

WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin WP Delicious versions = 1.9.1...

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions = 4.0.3...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

WordPress Login Page Customizer – Customizer Login Page, Admin Page, Custom Design plugin <= 2.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Nabil Irawan in WordPress Plugin Login Page Customizer Customizer Login Page, Admin Page, Custom Design versions = 2.1.1...

EUVD-2025-38272

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

WordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin ZoloBlocks versions = 2.3.11...