CVE-2025-49980

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through = 1.0.6...

Vulnerability of the mlx5e_rep_changelowerstate_event() function in the drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c file – This is a driver for supporting Mellanox Ethernet network adapters in the Linux operating system. It allows a hacker to cause a service failure.

Vulnerability of the mlx5erepchangelowerstateevent function in the drivers/net/ethernet/mellanox/mlx5/core/en/rep/bond.c module – The Mellanox Ethernet network adapter driver for Linux operating systems is vulnerable due to a reliance on the NULL pointer pointer. Exploiting this vulnerability cou...

Vulnerability of the ath11k_wmi_pdev_dfs_radar_detected_event() function in the drivers/net/wireless/ath/ath11k/wmi.c module – This driver provides support for Atheros/Qualcomm wireless adapter devices in the Linux operating system. It allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the ath11kwmipdevdfsradetectedevent function in the drivers/net/wireless/ath/ath11k/wmi.c module – the driver for Atheros/Qualcomm wireless adapter support in Linux operating systems – stems from the reutilization of previously freed memory. Exploiting this vulnerability can...

CVE-2025-6403

creationtimestamp| type| source ---|---|--- 2025-06-21 10:43:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19112 2025-06-21 11:00:51+00:00| published-proof-of-concept| Telegram/qsFsY5R1xxIgULEpk0U8Epvp3fQzfiVjHfp2vh0CbDVQ5U 2025-06-21 14:13:49+00:00| seen|...

Scattered Spider Behind Cyberattacks on M&S and Co-op, Causing Up to $592M in Damages

The April 2025 cyber attacks targeting U.K. retailers Marks & Spencer and Co-op have been classified as a "single combined cyber event." That's according to an assessment from the Cyber Monitoring Centre CMC, a U.K.-based independent, non-profit body set up by the insurance industry to categorize...

GHSA-34GH-G567-HQ85

creationtimestamp| type| source ---|---|--- 2025-06-21 02:03:08+00:00| seen| Telegram/VYISubODK9o2EhmMQtV1Poo-UEd9SUXrb4Hppof0xM5PUw 2025-06-21 03:25:29+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19099...

CVE-2025-38048

In the Linux kernel, the following vulnerability has been resolved: virtioring: Fix data race by tagging eventtriggered as racy for KCSAN syzbot reports a data-race when accessing the eventtriggered, here is the simplified stack when the issue occurred:...

CVE-2025-49965

creationtimestamp| type| source ---|---|--- 2025-06-20 16:44:46+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18990...

CVE-2025-52792

creationtimestamp| type| source ---|---|--- 2025-06-20 16:17:19+00:00| seen| Telegram/vPkHdTlHK4ikWxmUX8woH5Q86R3jDi2hkiCmD7tIHBczmU 2025-06-23 16:47:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19230...

CVE-2025-49980

Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Profile Avatar: from n/a through = 1.0.6...

CVE-2025-49972

CVE-2025-49972 concerns the WordPress plugin TM Replace Howdy (versions

CVE-2025-49980

CVE-2025-49980 concerns the WordPress plugin WP User Profile Avatar (affected: versions up to 1.0.6) and is a Missing Authorization / broken access control vulnerability. The CVE describes an exposure where access control is misconfigured, enabling exploitation via unauthorized actions. Public so...

CVE-2025-32880

creationtimestamp| type| source ---|---|--- 2025-06-20 14:43:44+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18967...

CVE-2022-50136

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IWCMEVENTCONNECTREPLY event If siwrecvmparr returns -EAGAIN, it means that the MPA reply hasn't been received completely, and should not report IWCMEVENTCONNECTREPLY in this case. This may trigge...

CVE-2022-50075

In the Linux kernel, the following vulnerability has been resolved: tracing/eprobes: Have event probes be consistent with kprobes and uprobes Currently, if a symbol "@" is attempted to be used with an event probe eprobes, it will cause a NULL pointer dereference crash. Both kprobes and uprobes ca...

CVE-2022-50078

In the Linux kernel, the following vulnerability has been resolved: tracing/eprobes: Do not allow eprobes to use $stack, or % for regs While playing with event probes eprobes, I tried to see what would happen if I attempted to retrieve the instruction pointer %rip knowing that event probes do not...

PT-2025-26348 · WordPress +1 · Wp User Profile Avatar +1

Name of the Vulnerable Software and Affected Versions: WP User Profile Avatar versions 1.0.0 through 1.0.6 Description: The issue is related to a Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar, which allows exploiting incorrectly configured access control security...

CVE-2025-36050

IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user...

CVE-2025-6269

creationtimestamp| type| source ---|---|--- 2025-06-19 16:45:42+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18870 2025-06-19 19:41:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrybqzhtkg25...

CVE-2025-48886 hydra-node dangerously assumes L1 event finality and does not consider failed transactions

Hydra is a layer-two scalability solution for Cardano. Prior to version 0.22.0, the process assumes L1 event finality and does not consider failed transactions. Currently, Cardano L1 is monitored for certain events which are necessary for state progression. At the moment, Hydra considers those...