CVE-2025-63210

The Newtec Celox UHD models: CELOXA504, CELOXA820 running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifying intercepted responses from the /celoxservice endpoint. By injecting a forged response body during the loginWithUserNa...

PT-2025-47500

Name of the Vulnerable Software and Affected Versions Newtec Celox UHD versions celox-21.6.13 Description The Newtec Celox UHD models CELOXA504, CELOXA820 is affected by an authentication bypass. An attacker can gain Superuser or Operator access without valid credentials by modifying intercepted...

CVE-2025-63220

The CVE-2025-63220 entry concerns Sound4 FIRST's web-based management interface. The vulnerability is Remote Code Execution (RCE) via a malicious firmware update package, caused by the update mechanism failing to validate the integrity of the manual.sh script. An attacker could modify this script...

CVE-2025-63210

The Newtec Celox UHD models: CELOXA504, CELOXA820 running firmware version celox-21.6.13 is vulnerable to an authentication bypass. An attacker can exploit this issue by modifying intercepted responses from the /celoxservice endpoint. By injecting a forged response body during the loginWithUserNa...

CVE-2025-51663

A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share...

CVE-2025-62406 Piwigo is vulnerable to one-click account takeover by modifying the password-reset link

Piwigo is a full featured open source photo gallery application for the web. In Piwigo 15.6.0, using the password reset function allows sending a password-reset URL by entering an existing username or email address. However, the hostname used to construct this URL is taken from the HTTP request's...

CVE-2025-9625

The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the mayberestrictcontent function. This makes it possible...

CVE-2025-12406 Project Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage function. This makes it possible for unauthenticated attackers to update setting...

CVE-2025-12173

CVE-2025-12173 concerns the WordPress plugin WP Admin Microblog (versions ≤ 3.1.1). Wordfence details indicate a Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the wp-admin-microblog page, enabling unauthenticated attackers to post messages on behalf of an admin...

CVE-2025-9625 Coil Web Monetization <= 2.0.2 - Cross-Site Request Forgery

The Coil Web Monetization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the coil-get-css-selector parameter handling in the mayberestrictcontent function. This makes it possible...

PT-2025-47413

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 15.7.0 Description Piwigo is a photo gallery application for the web. The password reset function in versions prior to 15.7.0 does not validate the hostname used in the password-reset URL, which is taken directly from...

OESA-2025-2653 bind security update

Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS protocols and provides an openly redistributable reference implementation of the major components of the Domain Name System. This package includes the components to operate a DNS server. Security Fixes: Under...

org.keycloak/keycloak-services: WebAuthn Attestation Statement Verification Bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

Malicious code in nudela-gagagaafh0afhf-gafsafoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33516ad4a113964856f6c06a665cbe2e246314ec3c4b12d251a54fb95ad87161 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

CVE-2025-37734

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

CVE-2025-37734 Kibana Origin Validation Error

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

EUVD-2025-124976

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant...

CVE-2025-37734

CVE-2025-37734 describes an Origin Validation Error in Kibana that can enable Server-Side Request Forgery when a forged Origin header is processed by the Observability AI Assistant. Publicly cited details indicate affected Kibana versions include 8.12.x prior to 8.19.7, 9.1.x prior to 9.1.7, and ...

Origin Validation Error

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Origin Validation Error via improper validation of the Origin HTTP header in the Observability AI Assistant. An attacker can make...