PT-2025-48802

Name of the Vulnerable Software and Affected Versions Nagvis Checkmk MultisiteAuth versions prior to 1.9.48 Description An unauthenticated attacker can enumerate Checkmk usernames. This issue affects the user enumeration functionality within the software. Recommendations Update to version 1.9.48 ...

Oracle Linux 9 : python-kdcproxy (ELSA-2025-21139)

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2025-21139 advisory. - Use DNS discovery for declared realms only CVE-2025-59088 Resolves: RHEL-122779 Tenable has extracted the preceding description block directly from...

CVE-2025-13372

creationtimestamp| type| source ---|---|--- 2025-12-02 14:49:11+00:00| seen| https://seclists.org/oss-sec/2025/q4/226 2025-12-02 16:31:29+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m6zekey5zw22 2025-12-02 23:17:00+00:00| seen|...

WordPress SKT PayPal for WooCommerce plugin <= 1.4 - Unauthenticated Payment Bypass vulnerability

Unauthenticated Payment Bypass vulnerability discovered by ch4r0n - FPT Software in WordPress Plugin SKT PayPal for WooCommerce versions = 1.4...

WordPress Houzez plugin <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search vulnerability

Authenticated Subscriber+ PHP Object Injection via Saved Search vulnerability discovered by Alex Thomas - Wordfence in WordPress Theme Houzez versions = 4.1.6...

WordPress Hide Category by User Role for WooCommerce plugin <= 2.3.1 - Missing Authorization to Unauthenticated Cache Flushing vulnerability

Missing Authorization to Unauthenticated Cache Flushing vulnerability discovered by Legion Hunter in WordPress Plugin Hide Category by User Role for WooCommerce versions = 2.3.1...

WordPress Shouty plugin <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via shouty Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via shouty Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Shouty versions = 0.2.1...

CVE-2025-58360

creationtimestamp| type| source ---|---|--- 2025-11-26 18:02:43+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/60873 2025-11-26 21:00:05+00:00| published-proof-of-concept| Telegram/EQSEx6hVvMlnJ1ky7huxK4eSzyICfuehitJwgPSzGmUZN8M 2025-11-27 05:09:25+00:00| confirmed|...

WordPress AI Feeds plugin <= 1.0.11 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Ryan Kozak in WordPress Plugin AI Feeds versions = 1.0.11...

Exploit for CVE-2024-32019

CVE-2024-32019 Proof of Concept Python A Python implementat...

WhatsApp closes loophole that let researchers collect data on 3.5B accounts

Messaging giant WhatsApp has around three billion users in more than 180 countries. Researchers say they were able to identify around 3.5 billion registered WhatsApp accounts thanks to a flaw in the software. That higher number is possible because WhatsApp’s API returns all accounts registered to...

Hey There! You Are Using WhatsApp: Enumerating Three Billion Accounts for Security and Privacy

WhatsApp, with 3.5 billion active accounts as of early 2025, is the world's largest instant messaging platform. Given its massive user base, WhatsApp plays a critical role in global communication. To initiate conversations, users must first discover whether their contacts are registered on the...

python-kdcproxy security update

1.0.0-9 - Use DNS discovery for declared realms only CVE-2025-59088 Resolves: RHEL-122779 - Fix DoS vulnerability based on unbounded TCP buffering CVE-2025-59089 Resolves: RHEL-122778...

Effective Command-Line Interface Fuzzing with Path-Aware Large Language Model Orchestration

Command-line interface CLI fuzzing tests programs by mutating both command-line options and input file contents, thus enabling discovery of vulnerabilities that only manifest under specific option-input combinations. Prior works of CLI fuzzing face the challenges of generating semantics-rich opti...

WordPress Peer Publish plugin <= 1.0 - Cross-Site Request Forgery vulnerability

Cross-Site Request Forgery vulnerability discovered by dayea song - Ahnlab in WordPress Plugin Peer Publish versions = 1.0...

Important: Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage

A Subscription Management tool for finding and reporting Red Hat product usage Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds, identifies, and reports environment data, or facts, such as the number of physical and virtual systems on a network, their...

WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin PropertyHive versions = 2.1.12...

WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Better Search versions = 4.2.1...

CVE-2025-64310

EPSON WebConfig and Epson Web Control for SEIKO EPSON Projector Products do not restrict excessive authentication attempts. An administrative user's password may be identified through a brute force attack...

GHSA-F6X5-JH6R-WRFV vulnerabilities

Vulnerabilities for packages: fq, kube-vip-cloud-provider, prometheus-alertmanager, crossplane-provider-azure, timescaledb-parallel-copy, snyk-cli, sftpgo-plugin-auth, kafka-proxy, pgtimetable, vault-env, gitleaks, local-static-provisioner, kubescape-operator, rancher-fleet,...