15,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Dokan Pro WordPress Plugin

📢 Calling all Vulnerability Researchers and Bug Bounty Hunters!📢 🌞 Spring into Summer with Wordfence! Now through September 4, 2025, earn 2X bounty rewards forall in-scope submissions from our ‘High Threat’ list in software with fewer than 5 million active installs. Bounties up to $31,200 per...

Dynatrace: OneAgent Unprivileged NTLM User Coercion

Vulnerability description not provided...

PT-2025-34520 · Undefined · Undefined

Apple released another CVE: CVE-2025-43280 •Impact: Processing web content may lead to arbitrary code execution •Description: The issue was resolved by not loading remote images ios applesecurity ios18 bugbountytip apple bugbounty applebugbounty...

curl: Missing Security Headers

Missing Security Headers Low Target: https://curl.se/ OWASP Mapping: A05 Misconfiguration / A02 Crypto Vulnerability ID: sec-headers-0f70ef5bcb Description A Missing Security Headers issue was discovered. This may allow an attacker to exploit the application. Proof of Concept Using cURL bash curl...

Wordfence Bug Bounty Program Monthly Report – July 2025

Last month in July 2025, the Wordfence Bug Bounty Program received 325 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence...

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

CVE-2025-34158

Summary: Plex Media Server (PMS) versions 1.41.7.x–1.42.0.x (before 1.42.1) are affected by token/credential disclosure through account and API surfaces, per CVE-2025-34158. Connected documents extend the impact to multiple PMS versions, noting PMS

CVE-2025-34158

Plex Media Server PMS 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner and a /api/resources call reveals other servers accessible by that server owner...

curl: curl leaks destination IP via glibc getaddrinfo() UDP connect, bypassing SOCKS5/Tor

Summary: When using curl with a SOCKS5 proxy e.g. Tor on 127.0.0.1:9050, glibc getaddrinfo performs direct UDP connect probes to the target’s IP:443. These syscalls bypass the proxy and expose the user’s route to the destination, breaking anonymity expectations. The IPs I got in my case:...

Nextcloud: Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner

Files drop share links for end-to-end encrypted folders allowed to drop files into other folders of the share owner...

WakaTime: Invalid

Summary: While testing the OAuth implementation on your platform, I discovered a critical vulnerability that allows a malicious attacker to take over any victim’s account and maintain persistent access even if the victim later verifies their email or changes their password. This issue arises...

curl: WebSocket Fragmentation DoS on Curl Client

Summary A malicious WebSocket server can send a fragmented message FIN=0 followed by a flood of continuation frames, causing the client curl to continuously allocate memory while waiting for message completion. This can result in high memory usage and potential crash OOM, representing a...

Node.js: CWE-195 in ExternalMemoryAccounter::Increase()

Summary: V8's ExternalMemoryAccounter::Increase expects an unsigned sizet argument, but a signed ssizet which in some cases results in garbage collection to happen during garbage collection. Here's a simplified version of what happens full backtrace has been attached in the issue:...

curl: ## Title Heap Use-After-Free Vulnerability in `curl` Leading to Potential Code Execution

Summary A Use-After-Free UAF vulnerability was discovered in curl at curltrc.c:195. When processing specially crafted input, the code accesses memory after it has already been freed. This can result in undefined behavior, leading to a denial of service crash and potentially enabling information...

MAL-2025-6915 Malicious code in bug-bounty-hunter (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in bug-bounty (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-6914 Malicious code in bug-bounty (npm)

The package communicates with a domain associated with malicious activity...

curl: Insecure WebSocket Usage in curl Documentation and Examples (CWE-319: Cleartext Transmission of Sensitive Information)

The curl source repository contains official documentation and example code that demonstrate WebSocket connections using the insecure ws:// protocol instead of the secure wss://. This misleading guidance may encourage developers to implement cleartext WebSocket endpoints, exposing users and...

curl: CVE-2025-9086: Out of bounds read for cookie path

We are tracking this issue with the public ID BIGSLEEP-437903454. Please use this identifier for reference in any future communication. Vulnerability Details In the cookie support found in cookie.c, there's an out-of-bounds string comparison that results from a crafted sequence of cookie...

curl: Vulnerability Report: Local File Disclosure via file:// Protocol in cURL

Summary A security vulnerability has been identified that allows unauthorized local file system access via the file:// protocol in cURL, particularly when executed with elevated privileges e.g., sudo. This could lead to sensitive data exposure, including password hashes stored in /etc/shadow. Ste...