CVE-2025-12383

creationtimestamp| type| source ---|---|--- 2025-05-07 15:48:27+00:00| seen| https://t.me/NinjaSec/300 2025-11-18 16:14:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5w53w67l62u 2026-01-16 15:45:08+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mckgwvnwux2z...

CVE-2025-46827

Graylog has a vulnerability (CVE-2025-46827) where an HTML form in an Event Definition Remediation Step can leak user session cookies if an attacker has create-event-definition rights and the victim can view alerts, with an active input to receive form data. Affected versions are before 6.0.14, 6...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

CVE-2025-46827 Graylog Allows Session Takeover via Insufficient HTML Sanitization

Graylog is a free and open log management platform. Prior to versions 6.0.14, 6.1.10, and 6.2.0, it is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with...

GHSA-76VF-MPMX-777J Graylog Allows Session Takeover via Insufficient HTML Sanitization

Impact It is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts...

Graylog Allows Session Takeover via Insufficient HTML Sanitization

Impact It is possible to obtain user session cookies by submitting an HTML form as part of an Event Definition Remediation Step field. For this attack to succeed, the attacker needs a user account with permissions to create event definitions, while the user must have permissions to view alerts...

CVE-2025-47531

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events allows PHP Local File Inclusion. This issue affects XT Event Widget for Social Events: from n/a through 1.1.7...

CVE-2025-47531

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

CVE-2025-47496

creationtimestamp| type| source ---|---|--- 2025-05-07 14:22:35+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15306...

CVE-2025-47504

creationtimestamp| type| source ---|---|--- 2025-05-07 14:22:27+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15299...

CVE-2025-47531 WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

CVE-2025-47531 WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Xylus Themes XT Event Widget for Social Events xt-facebook-events allows PHP Local File Inclusion.This issue affects XT Event Widget for Social Events: from n/a through = 1.1.7...

CVE-2025-20968

creationtimestamp| type| source ---|---|--- 2025-05-07 13:09:13+00:00| seen| https://t.me/cvedetector/24696...

[SECURITY] Fedora 41 Update: nodejs20-20.19.1-1.fc41

Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed...

SUSE CVE-2022-49858

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix SQE threshold checking Current way of checking available SQE count which is based on HW updated SQB count could result in driver submitting an SQE even before CQE for the previously transmitted SQE at the same...

The vulnerability in the web-based interface of UserGate Next-Generation Firewall (NGFW), the unified management center UserGate Management Center (UGMC), the log collection system UserGate Log Analyzer (LogAn), and the event tracking and analysis tool UserGate Security Information and Event Management (SIEM) allows a perpetrator to execute injection requests and trigger built-in database functions.

The vulnerability in the web-based interface of the UserGate Next-Generation Firewall NGFW, the unified management center UserGate Management Center UGMC, and the log collection system UserGate Log Analyzer LogAn is related to insufficient validation of input data. Exploiting this vulnerability...

WordPress plugin XT Event Widget for Social Events 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Configure Audit Rules for File Access Failures

System calls, such as open, truncate, ftruncate, create and openat, are audited and monitored. If the -EACCES or -EPERM error is returned, you lack the permission to access the files. In this case, audit logs need to be recorded. File access failures due to a lack of proper permissions are common...

Graylog 跨站脚本漏洞

Graylog is a centralized log management solution from the US company Graylog. The product supports capturing, storing, and analyzing logs in real-time, among other things. A cross-site scripting vulnerability exists in Graylog versions prior to 6.2.0, which stems from an HTML form that can be...

PT-2025-20150 · Xylus Themes · Xylus Themes Xt Event Widget For Social Events

Name of the Vulnerable Software and Affected Versions: Xylus Themes XT Event Widget for Social Events versions 1.1.7 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion' or PHP Loca...