A Simple WhatsApp Security Flaw Exposed 3.5 Billion Phone Numbers

By plugging tens of billions of phone numbers into WhatsApp’s contact discovery tool, researchers found “the most extensive exposure of phone numbers” ever—along with profile photos and more...

EUVD-2025-197911

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...

CVE-2025-12974

The Gravity Forms plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the legacy chunked upload mechanism in all versions up to, and including, 2.9.21.1. This is due to the extension blacklist not including .phar files, which can be uploaded through...

WordPress Cryptocurrency Payment Gateway for WooCommerce plugin <= 2.0.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Cryptocurrency Payment Gateway for WooCommerce versions = 2.0.25...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-50083)

tcp: vulnerability in may cause DSS corruption due to large PMTU transmissions, which is fixed by addressing the issue in the mptcpmoveskbsfromsubflow function. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 809...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 1.2.35 - Unauthenticated SQL Injection via search vulnerability

Unauthenticated SQL Injection via search vulnerability discovered by YCInfosec in WordPress Plugin Amelia versions = 1.2.35...

A Guide to Exposure Management Cybersecurity Best Practices

Attackers don't think in terms of CVE scores. They look for the path of least resistance, whether it's a forgotten server, a misconfigured cloud bucket, or an exposed API. While your team is busy prioritizing a long list of software flaws, a real threat could be exploiting a simple oversight that...

CVE-2025-13267

creationtimestamp| type| source ---|---|--- 2025-11-17 11:18:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5t43jr2ww2k...

Security Bulletin: Due to the use of Protobuf Pure-Python backend, IBM Watson Discovery Cartridge is vulnerable to corruption by exceeding the Python recursion limit

Summary IBM Watson Discovery Cartridge uses Protobuf Pure-Python backend for gRPC communication between the Python IOCR service and the Scala/Java pipeline components Vulnerability Details CVEID:CVE-2025-4565 DESCRIPTION: Any project that uses Protobuf Pure-Python backend to parse untrusted...

WordPress SKT Skill Bar plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin SKT Skill Bar versions = 2.5...

Oracle Linux 8 : idm:DL1 (ELSA-2025-21140)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-21140 advisory. - Use DNS discovery for declared realms only CVE-2025-59088 Resolves: RHEL-113657 Tenable has extracted the preceding description block directly from...

idm:DL1 security update

bind-dyndb-ldap 11.6-6 - Fix rpminspect warnings Resolves: RHEL-22497 custodia ipa 4.9.13-20.0.1 - Set IPAPLATFORM=rhel when build on Oracle Linux Orabug: 29516674 ipa-healthcheck opendnssec 2.1.7-2 - Don't creat /var/run/opendnssec directory - Resolves: RHEL-12163 python-jwcrypto python-kdcproxy...

Siemens SIMATIC S7-1500 Exposure of Sensitive Information to an Unauthorized Actor (CVE-2020-8284)

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service...

Drupal core 8.0.0-10.4.8,10.5.0-10.5.5,11.0.0-11.1.8,11.2.0-11.2.7 - Authenticated Other Vulnerability Type vulnerability

Authenticated Other Vulnerability Type vulnerability discovered by anzuukino in WordPress Core Drupal versions 8.0.0-10.4.8,10.5.0-10.5.5,11.0.0-11.1.8,11.2.0-11.2.7...

EUVD-2025-98818

Malicious code in fitri-miebogor65-riris npm...

EUVD-2025-74273

Malicious code in secondarychickadeeamaranth-93 npm...

EUVD-2025-63293

Malicious code in linearocelotz3n npm...

WordPress Skip to Timestamp plugin <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by zakaria in WordPress Plugin Skip to Timestamp versions = 1.4.4...

EUVD-2025-48413

Malicious code in cici-sate37-sukiwir npm...

WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Seriously Simple Podcasting versions = 3.13.0...