CVE-2025-13093

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

Improper Access Control

apacheairflow is vulnerable to improper access control. The vulnerability is due to insufficient authorization checks in the bulk create API with the overwrite action, which allows an attacker with only CREATE privileges to update existing Pools, Connections, and Variables without having UPDATE...

Out-of-Bounds Read

mongodb/mongodb-extension is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper handling of large options in mongocbulkoperationt, which allows an attacker to trigger invalid memory reads and potentially cause a crash or information disclosure...

CVE-2025-13093 Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

CVE-2025-13093

CVE-2025-13093 affects the WordPress plugin “Devs CRM – Manage tasks, attendance and teams all together” and concerns an unauthorized data modification vulnerability. The issue is caused by a missing capability check on the REST-API endpoint /wp-json/devs-crm/v1/bulk-update and affects all versio...

CVE-2025-14454 Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

PT-2025-51061

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

CVE-2025-14454: Cross-Site Request Forgery (CSRF)

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

WordPress plugin Image Slider by Ays- Responsive Slider and Carousel 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...

CVE-2025-13093: Missing Authorization

The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This makes it possible...

PT-2025-51048

The Image Slider by Ays- Responsive Slider and Carousel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.0. This is due to missing or incorrect nonce validation on the bulk delete functionality. This makes it possible for unauthenticated...

OESA-2025-2824 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2823 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2821 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

OESA-2025-2822 mongo-c-driver security update

Security Fixes: A mongocbulkoperationt may read invalid memory if large options are passed.CVE-2025-12119...

Exploit for Deserialization of Untrusted Data in Facebook React

CVE-2025-55182 Exploitation Tool A comprehensive security res...

Exploit for Deserialization of Untrusted Data in Facebook React

R2SAE - React2Shell Auto-Exploit A Firefox extension...

CVE-2023-53840

The CVE-2023-53840 issue in the Linux kernel is fixed in the usb: early: xhci-dbc path. If xdbc_bulk_write() fails, the contents of buf could be non-deterministic and not NULL-terminated when xdbc_trace() runs, risking a potential out-of-bounds read. The patch reserves an extra byte in the static...

CVE-2023-53840 usb: early: xhci-dbc: Fix a potential out-of-bound memory access

In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbcbulkwrite fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbctrace is called. Reserve an extra byte,...

Nextcloud Server 31.0.0 File Tag Modification Vulnerability (GHSA-hq6c-r898-fgf2)

Nextcloud Server is prone to a file tag modification vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...