CVE-2025-30150 Shopware 6 allows attackers to check for registered accounts through the store-api

Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates...

CVE-2025-3408

A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stbdupreplace. The manipulation leads to integer overflow. The attack may be launched remotely. Continious delivery with rolling releases is used by this product...

📄 UNA CMS 14.0.0-RC4 PHP Object Injection

UNA CMS versions 14.0.0-RC4 and below suffer from a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php. ------------------------------------------------------------------------------------ UNA CMS = 14.0.0-RC4 BxBaseMenuSetAclLevel.php PHP Object Injection Vulnerability...

CVE-2025-3426

We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfuscated, and no measures are in place to protect against decompilation, disassembly, or debugging. As a result, attackers can reverse-enginee...

CVE-2025-32101

creationtimestamp| type| source ---|---|--- 2025-04-07 15:43:12+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3lmacfz7k7i26 2025-04-07 17:39:32+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3lmaivzqr2u2l 2025-04-09 10:42:31+00:00| confirmed|...

CVE-2025-3333

creationtimestamp| type| source ---|---|--- 2025-04-07 06:32:02+00:00| published-proof-of-concept| Telegram/EsnBsJ3Ssj-UYUC8Y7f1dDSxyldCCaK6EjJlv4mvyH2MMw 2025-04-07 07:01:17+00:00| seen| https://t.me/cvedetector/22239...

📄 Microchip TimeProvider 4100 Grandmaster 2.4.6 Command Injection

Microchip TimeProvider 4100 Grandmaster version 2.4.6 suffers from a remote command injection vulnerability. Exploit Title: Microchip TimeProvider 4100 Grandmaster Config File - Remote Code Execution RCE Exploit Author: Armando Huesca Prida Discovered By: Armando Huesca Prida, Marco Negro, Antoni...

PT-2025-18395

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.0-rc3 Description A vulnerability in the Linux kernel has been resolved, specifically in the KVM Kernel-based Virtual Machine module. The issue arises when the vCPU is in L2 with INIT and a TRIPLE FAULT...

CVE-2025-21997 xsk: fix an integer overflow in xp_create_and_assign_umem()

In the Linux kernel, the following vulnerability has been resolved: xsk: fix an integer overflow in xpcreateandassignumem Since the i and pool-chunksize variables are of type 'u32', their product can wrap around and then be cast to 'u64'. This can lead to two different XDP buffers pointing to the...

WordPress Tiger theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Theme Tiger versions = 2.0...

CVE-2025-31131

creationtimestamp| type| source ---|---|--- 2025-04-01 16:32:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9944 2025-04-01 17:48:23+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114263962596198001 2025-04-01 17:48:23+00:00| seen|...

CVE-2025-21978

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: Fix address space leak when Hyper-V DRM device is removed When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for devic...

CVE-2025-24247

creationtimestamp| type| source ---|---|--- 2025-04-01 14:33:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/9905 2026-04-02 22:15:08+00:00| seen| Telegram/A1zSU9KcM20ZRLemoMFRz3NG5DsD-KNcnO6EGaNoIwAY1a4...

What’s New in Rapid7 Products & Services: Q1 2025 in Review

At Rapid7, we started off the year focused on delivering new features and advancements across our products and services to bring you the context needed to prioritize exposures, visualize your attack surface, and accelerate incident response. Read on for Q1 2025 release highlights across the Comma...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero CVE-2024-26982 In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix NULL pointer dereference in object-file...

WordPress WP Pro Real Estate 7 plugin <= 3.5.4 - Authenticated (Seller) Arbitrary File Upload vulnerability

Authenticated Seller Arbitrary File Upload vulnerability discovered by Foxyyy in WordPress Theme Real Estate 7 versions = 3.5.4...

WordPress Themify Sidepane WordPress theme <=1.9.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Theme Themify Sidepane WordPress Theme versions = 1.9.8...

WordPress PostmarkApp Email Integrator plugin <= 2.4 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin PostmarkApp Email Integrator versions = 2.4...

CVE-2025-2910

User enumeration in the password reset module of the MeetMe authentication service in versions prior to 2024-09 allows an attacker to determine whether an email address is registered through specific error messages...

WordPress Material Dashboard plugin <= 1.4.5 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by LVT-tholv2k in WordPress Plugin Material Dashboard versions = 1.4.5...