WordPress Homey theme <= 2.4.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary User Deletion vulnerability discovered by a00n in WordPress Theme Homey versions = 2.4.4...

npm Malware Targets Crypto Wallets, MongoDB; Code Points to Turkey

Sonatype discovered 'crypto-encrypt-ts', a malicious npm package impersonating the popular CryptoJS library to steal crypto and personal data.…...

DEBIAN-CVE-2025-37756

In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago...

CVE-2025-23156

In the Linux kernel, the following vulnerability has been resolved: media: venus: hfiparser: refactor hfi packet parsing logic wordscount denotes the number of words in total payload, while data points to payload of various property within it. When wordscount reaches last word, data can access...

CVE-2025-37756 net: tls: explicitly disallow disconnect

In the Linux kernel, the following vulnerability has been resolved: net: tls: explicitly disallow disconnect syzbot discovered that it can disconnect a TLS socket and then run into all sort of unexpected corner cases. I have a vague recollection of Eric pointing this out to us a long time ago...

CVE-2025-3874 WordPress Simple PayPal Shopping Cart <= 5.1.3 - Insecure Direct Object Reference

The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to lack of randomization of a user controlled key. This makes it possible for unauthenticated attackers to access customer shopping carts and...

[SECURITY] [DSA 5911-1] request-tracker4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5911-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 30, 2025 https://www.debian.org/security/faq -...

CVE-2025-4087

creationtimestamp| type| source ---|---|--- 2025-04-29 15:50:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnxn32lndg2y 2025-04-29 16:49:43+00:00| seen| https://t.me/cvedetector/23999...

DejaVuzz: Disclosing Transient Execution Bugs with Dynamic Swappable Memory and Differential Information Flow Tracking Assisted Processor Fuzzing

Transient execution vulnerabilities have emerged as a critical threat to modern processors. Hardware fuzzing testing techniques have recently shown promising results in discovering transient execution bugs in large-scale out-of-order processor designs. However, their poor microarchitectural...

Exploit for Path Traversal in Zoneminder

CVE-2022-29806 ZoneMinder up to 1.36.12 Language privilege esc...

Securing GenAI Multi-Agent Systems against Tool Squatting: a Zero Trust Registry-Based Approach

The rise of generative AI GenAI multi-agent systems MAS necessitates standardized protocols enabling agents to discover and interact with external tools. However, these protocols introduce new security challenges, particularly; tool squatting; the deceptive registration or representation of tools...

Ubuntu: Security Advisory (USN-7455-4)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Camtruder - Advanced RTSP Camera Discovery and Vulnerability Assessment Tool

Camtruder is a high-performance RTSP camera discovery and vulnerability assessment tool written in Go. It efficiently scans and identifies vulnerable RTSP cameras across networks using various authentication methods and path combinations, with support for both targeted and internet-wide scanning...

CVE-2025-3644

A flaw was found in Moodle. Additional checks were required to prevent users from deleting course sections they did not have permission to modify...

Automating Function-Level TARA for Automotive Full-Lifecycle Security

As modern vehicles evolve into intelligent and connected systems, their growing complexity introduces significant cybersecurity risks. Threat Analysis and Risk Assessment TARA has therefore become essential for managing these risks under mandatory regulations. However, existing TARA automation...

CVE-2025-46485

creationtimestamp| type| source ---|---|--- 2025-04-24 17:06:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13297...

Shrinking Lifespans, Growing Risk: The Final Certificate Countdown

Recent Developments Severely Shorten Certificate Lifespans. The SSL/TLS ecosystem is shifting rapidly and not in a way that favors already stretched teams. Historically, certificates could be valid for up to 10 years. Certificates now face drastically shorter lifespans. DigiCert and other major...

The vulnerability of the Packet Forwarding Engine (PFE) module in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a hacker to trigger a service failure.

The vulnerability of the Packet Forwarding Engine PFE module in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to memory release errors. Exploiting this vulnerability can allow a malicious actor to trigger service failures using specially created ARP packets in the...

The vulnerability of the Control Protocol Director (l2cpd) in Juniper Networks’ Junos OS and Junos OS Evolved operating systems allows a attacker to cause a service failure.

The vulnerability of the Control Protocol Director l2cpd in Juniper Networks’ Junos OS and Junos OS Evolved operating systems is related to type errors in implicit conversions. Exploiting this vulnerability can allow a malicious actor to trigger a service failure by sending a specially crafted LL...

CVE-2025-28034

creationtimestamp| type| source ---|---|--- 2025-04-22 14:03:29+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12841 2025-04-22 15:05:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnfxbopzhr2b 2025-04-22 18:24:18+00:00| seen|...