Understanding CVE-2025-55315: What CISOs, security engineers, and sysadmins should know

On October 14, 2025, Microsoft released a security update addressingCVE-2025-55315, a vulnerability in ASP.NET Core that allows HTTP request smuggling. While request smuggling is a known technique, this security update addresses a scenario with a high CVSS score to help encourage mitigation actio...

PT-2025-47220

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 142.0.7444.59 Description A type confusion issue exists in the V8 component of Google Chrome. This could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page...

Advisory ROSA-SA-2025-3041

Software: cups 2.2.6 OS: ROSA Virtualization 3.0 unaffected versions = cups-2.2.6-63.rv30 affected versions cups-2.2.6-63.rv30 CVE-ID: CVE-2025-58060 BDU-ID: 2025-11019 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the CUPS Common UNIX Printing System is related to flaws in the authentication...

Advisory ROSA-SA-2025-3040

Software: gnutls 3.6.16 OS: ROSA Virtualization 2.1 unaffected versions = gnutls-3.6.16-8.0.1.rv3.4 affected versions gnutls-3.6.16-8.0.1.1.rv3.4 CVE-ID: CVE-2024-12243 BDU-ID: None CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in GnuTLS when processing ASN.1 data via libtasn1 could result in...

Advisory ROSA-SA-2025-3037

Software: postgresql14 14.18 OS: rosa-server79 unaffected versions = postgresql14-14.18-1PGDG.res7 affected versions postgresql14-14.18-1PGDG.res7 CVE-ID: CVE-2023-5869 BDU-ID: 2023-07840 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the arrayappend, arrayprepend, and arraysubscripthandler functio...

Exploit for CVE-2025-22167

README — CVE-2025-22167 Atlassian Jira For defensive us...

WordPress wpForo Forum plugin <= 2.4.8 - Unauthenticated SQL Injection via get_members Function vulnerability

Unauthenticated SQL Injection via getmembers Function vulnerability discovered by mikemyers in WordPress Plugin wpForo Forum versions = 2.4.8...

WordPress Charitable plugin <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection vulnerability

Authenticated Subscriber+ SQL Injection vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Charitable versions = 1.8.8.4...

WordPress Directorist plugin <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move vulnerability

Authenticated Subscriber+ Arbitrary File Move vulnerability discovered by Arkadiusz Hydzik in WordPress Plugin Directorist versions = 8.4.8...

WordPress Quickcreator – AI Blog Writer plugin 0.0.9-0.1.17 - Unauthenticated API Key Exposure vulnerability

Unauthenticated API Key Exposure vulnerability discovered by kr0d in WordPress Plugin Quickcreator – AI Blog Writer versions 0.0.9-0.1.17...

CVE-2025-22167

This High severity Path Traversal Arbitrary Write vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal Arbitrary Write vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem...

PT-2025-43490

Name of the Vulnerable Software and Affected Versions MmsProvider.java affected versions not specified Description A path traversal error exists in multiple functions within MmsProvider.java, potentially allowing arbitrary file deletion affecting telephony, SMS, and MMS functionalities. This coul...

WordPress NS Maintenance Mode for WP plugin <= 1.3.1 - Unauthenticated Subscribers Export vulnerability

Unauthenticated Subscribers Export vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin NS Maintenance Mode for WP versions = 1.3.1...

CVE-2025-53072

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing...

WordPress FormGent plugin < 1.0.4 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin FormGent versions 1.0.4...

CVE-2025-53072

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite component: Marketing Administration. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Marketing...

CVE-2025-22166

This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2025-22166

This High severity DoS Denial of Service vulnerability was introduced in version 2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.3, allows an attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2025-22166

CVE-2025-22166 is a Denial of Service vulnerability affecting Atlassian Confluence Data Center. Introduced in Confluence Data Center 2.0, it enables an unauthenticated remote attacker to render the host unavailable by disrupting services, with high impact on availability. The advisory recommends ...

XenServer Security Update for CVE-2025-58147 and CVE-2025-58148

Severity: High Description of Problem Several issues have been identified in XenServer 8.4 that may allow privileged code in a guest VM to compromise or crash the host. These issues have the following identifiers: CVE-2025-58147 CVE-2025-58148 Affected Versions These issues affect XenServer 8.4...