PT-2025-45218

Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sertifier Certificate & Badge Maker: from n/a through = 1.21...

Fedora: Security Advisory (FEDORA-2025-976ccd79ae)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-62720

LinkAce is a self-hosted archive to collect website links. Versions 2.3.1 and below allow any authenticated user to export the entire database of links from all users in the system, including private links that should only be accessible to their owners. The HTML and CSV export functions in the...

Securing the Open Android Ecosystem with Samsung Knox

Raise your hand if you've heard the myth, "Android isn't secure." Android phones, such as the Samsung Galaxy, unlock new ways of working. But, as an IT admin, you may worry about the security—after all, work data is critical. However, outdated concerns can hold your business back from unlocking i...

Improper Authorization

Overview doris-mcp-server is an Enterprise-grade Model Context Protocol MCP server implementation for Apache Doris Affected versions of this package are vulnerable to Improper Authorization via improper enforcement of access controls for SQL queries. An attacker can perform unauthorized...

WordPress Essential Addons for Elementor plugin Authorization Missing Vulnerability

WordPress Essential Addons for Elementor plugin is an extension plugin designed for Elementor page builder, offering over 80 advanced widgets and modules for creating professional web designs. The WordPress Essential Addons for Elementor plugin suffers from an Authorization Missing vulnerability...

Unity Linux 20.1050e Security Update: kernel (UTSA-2025-990086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990086 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989243)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989243 advisory. In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in sndsocputvolswsx The bounds checks in...

CVE-2025-57130

ZwiiCMS up to v13.6.07 suffers an Incorrect Access Control flaw in the user management component that lets a remote, authenticated, low-privilege user escalate privileges by sending a specially crafted HTTP request to access/modify other users’ profiles (including admins). Documents consistently ...

What Is Attack Surface Mapping And Why It’s Critical To your Security Program

You might think an attack surface mapper is just another name for a vulnerability scanner, but they serve two very different purposes. A scanner tests the assets you already know about for specific weaknesses. An attack surface mapper answers a more fundamental question: What assets do I even hav...

PT-2025-45014

Name of the Vulnerable Software and Affected Versions WorkDo HRM SaaS HR and Payroll Tool version 8.1 Description WorkDo HRM SaaS HR and Payroll Tool version 8.1 has an issue with insecure permissions. An authenticated user is able to create leave or resignation records for other users...

EUVD-2025-37490

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls...

Inside an Automotive Giant’s Data Leak — A Cloud Misconfiguration Lesson for AWS Users

70 TB+ of data, hard-coded keys, and weak IAM controls. For even the most experienced enterprises, one configuration decision can be enough to surface how interdependent and vulnerable modern cloud systems truly are. The recent data exposure incident at a large automotive firm highlights this...

CVE-2025-36093

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls...

CVE-2025-36093

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls...

CVE-2025-36093

CVE-2025-36093 affects IBM Cloud Pak for Business Automation 25.0.0, 24.0.1, and 24.0.0. An improper access-control design could allow an attacker to access unauthorized content or perform unauthorized actions via man-in-the-middle techniques. This is supported by multiple connected sources ident...

WordPress plugin WP Snow Effect 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-36093: Client-Side Enforcement of Server-Side Security

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man in the middle techniques due to improper access controls...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Conditional IBPB mitigation has been added. VMSCAPE is a vulnerability that exploits the insufficient branch predictor isolation between a guest and a userspace hypervisor such as QEMU. Existing mitigations already...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/pm: fixed null pointer access issues. Writing a string without delimiters ' ', '\n', '\0' to the under gpuod/fanctrl sysfs or pppowerProfileMode for the CUSTOM profile will result in a null pointer dereference...