CVE-2025-66629

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the respon...

Researcher Uncovers 30+ Flaws in AI Coding Tools Enabling Data Theft and RCE Attacks

Over 30 security vulnerabilities have been disclosed in various artificial intelligence AI-powered Integrated Development Environments IDEs that combine prompt injection primitives with legitimate features to achieve data exfiltration and remote code execution. The security shortcomings have been...

CVE-2025-66629

HedgeDoc versions prior to 1.10.4 are affected by missing CSRF protection in OAuth2 endpoints for social logins (Google, GitHub, GitLab, Facebook, Dropbox) due to not sending/verifying a state parameter. This could allow attackers to hijack user authentication sessions. The issue is fixed in 1.10...

GHSA-J7C9-79X7-8HPR vulnerabilities

Vulnerabilities for packages: caddy...

GHSA-QGVM-92M2-J87G vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips...

GHSA-533C-PPXJ-MJQJ vulnerabilities

Vulnerabilities for packages: gitlab-operator-fips...

GHSA-495W-CQV6-WR59

creationtimestamp| type| source ---|---|--- 2025-12-05 16:43:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667959131777282...

CVE-2025-14104

creationtimestamp| type| source ---|---|--- 2025-12-05 16:41:15+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115667951619073794 2025-12-05 16:55:13+00:00| seen| https://gist.github.com/Darkcrai86/acab713a6562bbf2fe78f6ee421d7241 2025-12-05 17:16:43+00:00| seen|...

PromptPwnd Vulnerability Exposes AI driven build systems to Data Theft

Aikido Security exposes a new AI prompt injection flaw in GitHub/GitLab pipelines, letting attackers steal secrets. Major companies affected...

CGA-GC5M-FH7G-93XP

Bulletin has no description...

GHSA-2CF5-4W76-R9QV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce-fips...

Sift or Get off the PoC: Applying Information Retrieval to Vulnerability Research with SiftRank

Security research is fundamentally a problem of resource constraint and consequent prioritization. There is simply too much attack surface and too little time and energy to spend analyzing it all. The most effective security researchers are often those who are most skilled at intuitively deciding...

CGA-HJ4J-MCX4-5WRP

Bulletin has no description...

CGA-GGG9-36F6-QF33

Bulletin has no description...

CGA-Q4C5-96WQ-QQVC

Bulletin has no description...

GHSA-9MPM-9PXH-MG4F

creationtimestamp| type| source ---|---|--- 2025-12-03 20:46:44+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115657592254208627...

GHSA-V8V5-C872-MF8R

creationtimestamp| type| source ---|---|--- 2025-12-03 19:30:40+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115657293148457938...

Exploit for CVE-2025-55182

GitHub CVE Scanner 🔍 Quickly scan GitHub repositories for c...

CVE-2025-66220

creationtimestamp| type| source ---|---|--- 2025-12-03 17:01:36+00:00| published-proof-of-concept| https://github.com/envoyproxy/envoy/security/advisories/GHSA-rwjg-c3h2-f57p...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the deployments configured with ACME and SCEP provisioners. An attacker can gain unauthorized access to sensitive resources by bypassing authorization controls. Remediation Upgrade...