GHSA-FF6V-W58F-V97W XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right

Impact When a user without script right creates a document with an XWiki.Notifications.Code.NotificationEmailRendererClass object, and later an admin edits and saves that document, the email templates in this object will be used for notifications. No malicious code can be executed, though, as whi...

44% of people encounter a mobile scam every single day, Malwarebytes finds

It’s become so troublesome owning a phone. Malicious texts pose as package delivery notifications, phishing emails impersonate trusted brands, and unknown calls hide extortion attempts, virtual kidnapping schemes, or AI threats. Confusingly, even legitimate businesses now lean on outreach tactics...

CVE-2025-49283

Cross-Site Request Forgery CSRF vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, ReCaptcha for all forms and...

Weblate: exposure of personal IP address via email.

The exposure of personal IP addresses through email messages has been identified as a potential security issue. Email messages can pass through multiple servers, which may store or record the content, including the user's IP address, even if the email is encrypted during transit. The user's IP...

CVE-2025-21479

creationtimestamp| type| source ---|---|--- 2025-06-02 12:22:00+00:00| seen| https://thehackernews.com/2025/06/qualcomm-fixes-3-zero-days-used-in.html 2025-06-02 14:45:09+00:00| seen| https://poliverso.org/objects/0477a01e-80cca610-9993d4957996c583 2025-06-02 15:20:33+00:00| seen|...

A Swedish MMA Tournament Spotlights the Trump Administration's Handling of Far-Right Terrorism

A member of a California-based fight club seems to have attended an event hosted by groups with ties to an organization the US government labeled a terrorist group. Will the Trump administration care?...

CVE-2024-0140

NVIDIA RAPIDS contains a vulnerability in cuDF and cuML, where a user could cause a deserialization of untrusted data issue. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2022-40735

The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oorschot and Wiener paper found that "appropriately short exponents" can be used when there are adequate subgroup constraints, and these sho...

Malicious code in @bmwfedev/playwright-helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2019-14414

In cPanel before 78.0.2, a Userdata cache temporary file can conflict with domains SEC-478...

ArcGIS Insecure OAuth 2.0 Implementation

The ArcGIS clientcredentials OAuth 2.0 API implementation does not adhere to the RFC/standards; This hidden known and by-design, but undocumented functionality enables a requester referred to as client in RFC 6749 to request an, undocumented, custom token expiration from ArcGIS referred to as...

CVE-2025-4881

creationtimestamp| type| source ---|---|--- 2025-05-18 14:20:58+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lphawalir4b2 2025-05-18 17:12:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphkjxus5f2h...

CVE-2025-4382

CVE-2025-4382 affects GRUB2 in systems using LUKS-encrypted disks with TPM-based auto-decryption. The decryption key is read into memory when GRUB auto-decrypts, and if an attacker with physical access corrupts the filesystem superblock, GRUB may enter rescue mode with the disk already decrypted ...

CVE-2025-4382 Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

CVE-2025-4382 Grub2: grub allow access to encrypted device through cli once root device is unlocked via tpm

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

CVE-2025-4382

A flaw was found in systems utilizing LUKS-encrypted disks with GRUB configured for TPM-based auto-decryption. When GRUB is set to automatically decrypt disks using keys stored in the TPM, it reads the decryption key into system memory. If an attacker with physical access can corrupt the underlyi...

Shopify faces privacy lawsuit for collecting customer data

Shopify faces a data privacy class action lawsuit in the US that could change the way globally active companies can be held accountable. The proposed class action is a revival of a case that had been dismissed by a lower court judge and a three-judge 9th Circuit Court of Appeals panel. But now it...

CVE-2025-3518 File upload functionality possible even when disabled

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the...

CVE-2025-32851

creationtimestamp| type| source ---|---|--- 2025-04-16 20:48:33+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114349605425587251 2025-04-22 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-112-01...

Security Bulletin: Vulnerability in Apache Solr (lucene), Apache ZooKeeper and Logstash affect IBM Operations Analytics - Log Analysis (CVE-2024-9823, CVE-2024-47554)

Summary There is a potential denial of service with Apache Commons IO, Eclipse Jetty that affect Apache Solr lucene, Apache ZooKeeper and Logstash used by IBM Operations Analytics - Log Analysis Vulnerability Details CVEID:CVE-2024-9823 DESCRIPTION: There exists a security vulnerability in Jetty'...