CVE-2025-25188 DNSSEC validation may accept broken authentication chains

Hickory DNS is a Rust based DNS client, server, and resolver. A vulnerability present starting in version 0.8.0 and prior to versions 0.24.3 and 0.25.0-alpha.5 impacts Hickory DNS users relying on DNSSEC verification in the client library, stub resolver, or recursive resolver. The DNSSEC validati...

Malicious ML Models on Hugging Face Leverage Broken Pickle Format to Evade Detection

Cybersecurity researchers have uncovered two malicious machine learning ML models on Hugging Face that leveraged an unusual technique of "broken" pickle files to evade detection. "The pickle files extracted from the mentioned PyTorch archives revealed the malicious Python content at the beginning...

CVE-2025-25167 WordPress BookPress – For Book Authors Plugin <= 1.2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in blackandwhitedigital BookPress – For Book Authors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BookPress – For Book Authors: from n/a through 1.2.7...

CVE-2025-25120 WordPress Slide Banners plugin <= 1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Melodic Media Slide Banners allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Slide Banners: from n/a through 1.3...

CVE-2025-25110 WordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Kikfyre: from n/a through = 2.1.8...

CVE-2025-25110 WordPress Event Kikfyre plugin <= 2.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Metagauss Event Kikfyre allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Event Kikfyre: from n/a through 2.1.8...

CVE-2022-46850

Auth. author+ Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin = 0.1.3 versions...

CVE-2024-27936

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Starting in version 1.32.1 and prior to version 1.41.0 of the deno library, maliciously crafted permission request can show the spoofed permission prompt by inserting a broken ANSI escape sequence into the request...

CVE-2024-31093

Cross-Site Request Forgery CSRF vulnerability in Kaloyan K. Tsvetkov Broken Images allows Cross-Site Scripting XSS.This issue affects Broken Images: from n/a through 0.2...

CVE-2024-8981

The Broken Link Checker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg in /app/admin-notices/features/class-view.php without appropriate escaping on the URL in all versions up to, and including, 2.4.0. This makes it possible for unauthenticated...

CVE-2025-23058 Authenticated Broken Access Control Vulnerability in ClearPass Policy Manager Web-Based Management Interface

A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged read-only authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges...

CVE-2025-22730 WordPress Ksher plugin <= 1.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ksher Ksher allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ksher: from n/a through 1.1.2...

CVE-2025-22730

CVE-2025-22730 describes a Missing Authorization vulnerability in the WordPress Ksher plugin, affecting versions n/a through 1.1.2. The issue is caused by an incorrectly configured access control, enabling potential unauthorized access due to missing authorization checks. Multiple sources (RH, NV...

CVE-2025-22730 WordPress Ksher plugin <= 1.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ksher: from n/a through = 1.1.2...

CVE-2025-22643

CVE-2025-22643 affects FameThemes OnePress WordPress theme (versions

CVE-2025-22643 WordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in famethemes OnePress onepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnePress: from n/a through = 2.3.11...

CVE-2025-22696 WordPress Document Block – Upload & Embed Docs, PDF, PPT, XLS or Any Documents plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in EmbedPress Document Block – Upload & Embed Docs. This issue affects Document Block – Upload & Embed Docs: from n/a through 1.1.0...

BIT-MLFLOW-2024-4263 Improper Access Control in mlflow/mlflow

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing...

WordPress OnePress theme <= 2.3.11 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Theme OnePress versions = 2.3.11...

WordPress AIO Performance Profiler plugin <= 1.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin AIO Performance Profiler, Monitor, Optimize, Compress & Debug versions = 1.2...