CVE-2025-40906

CVE-2025-40906 concerns BSON::XS for Perl (versions <=0.8.4) bundling libbson 1.1.7, inheriting multiple older libbson vulnerabilities (e.g., CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, CVE-2025-0755). Connected advisories show libbson-related issues in the Mon...

CVE-2025-40906

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON...

Exploit for CVE-2025-47646

🔐 CVE-2025-47646 – PSW Front-end Login & Registration pswfo...

CVE-2025-32407

Samsung Internet for Galaxy Watch version 5.0.9, available up until Samsung Galaxy Watch 3, does not properly validate TLS certificates, allowing for an attacker to impersonate any and all websites visited by the user. This is a critical misconfiguration in the way the browser validates the...

CVE-2025-32407

CVE-2025-32407 affects Samsung Internet for Galaxy Watch, version 5.0.9 (widely deployed up to Galaxy Watch 3). The issue is improper TLS certificate validation in the browser, enabling an attacker to impersonate any visited website and potentially perform MitM attacks, with corresponding risk to...

WASP: Benchmarking Web Agent Security against Prompt Injection Attacks

Autonomous UI agents powered by AI have tremendous potential to boost human productivity by automating routine tasks such as filing taxes and paying bills. However, a major challenge in unlocking their full potential is security, which is exacerbated by the agent's ability to take action on their...

CVE-2025-47580

Missing Authorization vulnerability in Rustaurius Front End Users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through 3.2.32...

CVE-2025-47580

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through = 3.2.35...

CVE-2025-47580 WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Front End Users: from n/a through = 3.2.35...

CVE-2025-47580

CVE-2025-47580 (WordPress Front End Users plugin) : A Missing Authorization vulnerability exists in Front End Users up to version 3.2.32 that allows exploitation of misconfigured access control to access restricted information. A patch is available; update to 3.2.35+ (as noted by Patchstack) to r...

WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mika in WordPress Plugin Front End Users versions = 3.2.35...

Cross-site Scripting (XSS)

Overview org.webjars:bootstrap is a WebJar for Bootstrap. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Tooltip and Popover components due to improper neutralization of input during web page generation. An attacker can manipulate the output of web pages by...

Cross-site Scripting (XSS)

Overview org.webjars.npm:bootstrap is a WebJar for bootstrap. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Tooltip and Popover components due to improper neutralization of input during web page generation. An attacker can manipulate the output of web pages ...

Cross-site Scripting (XSS)

Overview org.webjars.bower:bootstrap is a popular front-end framework for faster and easier web development. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Tooltip and Popover components due to improper neutralization of input during web page generation. An...

Cross-site Scripting (XSS)

Overview org.webjars.bowergithub.twbs:bootstrap is a popular front-end framework for faster and easier web development. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Tooltip and Popover components due to improper neutralization of input during web page...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the EndBlocker process. An attacker can cause the system to halt by triggering an integer overflow during the cumulative reward ratio calculation. Remediation Upgrade...

WordPress plugin Front End Users 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-21344 · Unknown · Rustaurius Front End Users

Name of the Vulnerable Software and Affected Versions: Rustaurius Front End Users versions 3.2.32 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

The Ephemeral Threat: Assessing the Security of Algorithmic Trading Systems Powered by Deep Learning

We study the security of stock price forecasting using Deep Learning DL in computational finance. Despite abundant prior research on the vulnerability of DL to adversarial perturbations, such work has hitherto hardly addressed practical adversarial threat models in the context of DL-powered...

iTop 操作系统命令注入漏洞

iTop is a simple, web-based IT service management tool from Combodo Open Source. An operating system command injection vulnerability exists in iTop versions prior to 2.7.12, prior to 3.1.3, and prior to 3.2.1, which stems from the possibility of executing server code via the portal front-end...