Beyond the Worst Case: Extending Differential Privacy Guarantees to Realistic Adversaries

Differential Privacy DP is a family of definitions that bound the worst-case privacy leakage of a mechanism. One important feature of the worst-case DP guarantee is it naturally implies protections against adversaries with less prior information, more sophisticated attack goals, and complex...

📄 WordPress Events Manager 7.0.3 SQL Injection

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the orderby parameter in all versions up to, and including, 7.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

Fedora 41 : pam (2025-2a7a853bc7)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-2a7a853bc7 advisory. pamnamespace: fix potential privilege escalation. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that...

Fedora 41 : chromium (2025-c05ae72339)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-c05ae72339 advisory. Update to 138.0.7204.92 High CVE-2025-6554: Type Confusion in V8 Tenable has extracted the preceding description block directly from the Fedora...

WordPress Short URL plugin <= 1.6.8 - Subscriber+ SQLi vulnerability

Subscriber+ SQLi vulnerability discovered by Dao Xuan Hieu in WordPress Plugin Short URL versions = 1.6.8...

WordPress Event Manager plugin <= 7.0.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by mikemyers in WordPress Plugin Events Manager versions = 6.6.4.4...

CVE-2025-20319

In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability editscripted and listinputs capability , could perform a remote command execution due to improper user input sanitization on the scripted input files. See Defin...

Gold Melody IAB Exploits Exposed ASP.NET Machine Keys for Unauthorized Access to Targets

The Initial Access Broker IAB known as Gold Melody has been attributed to a campaign that exploits leaked ASP.NET machine keys to obtain unauthorized access to organizations and peddle that access to other threat actors. The activity is being tracked by Palo Alto Networks Unit 42 under the monike...

BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-crypto Dependency in Jira Service Management Data Center and Server

This High severity Third-Party Dependency vulnerability was introduced in versions 5.12.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0 and 10.7.0 of Jira Service Management Data Center and Server. This Third-Party Dependency vulnerability, with a CVSS Score of 7.4 and a CVSS Vector of...

CVE-2025-7214

A vulnerability classified as problematic was found in FNKvision FNK-GU2 up to 40.1.7. Affected by this vulnerability is an unknown functionality of the file /etc/shadow of the component MD5. The manipulation leads to risky cryptographic algorithm. It is possible to launch the attack on the...

CVE-2025-7214

CVE-2025-7214 affects FNKvision FNK-GU2 (≤ 40.1.7). The vulnerability involves an unspecified function in the MD5 component reading/writing the /etc/shadow file, leading to a risky cryptographic algorithm. Impact is described as feasible to launch on the physical device, with high attack complexi...

PT-2025-28837 · Fnkvision · Fnk-Gu2

Name of the Vulnerable Software and Affected Versions: FNKvision FNK-GU2 versions up to 40.1.7 Description: A critical vulnerability has been found in the UART Interface component of FNKvision FNK-GU2, allowing for improper access control to the on-chip debug and test interface. The attack can be...

Microsoft Word 2016 RCE Vulnerability (KB5002745)

This host is missing an important security update according to Microsoft KB5002745 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

WordPress SureForms Plugin <= 1.7.3 is vulnerable to Arbitrary File Deletion

Software SureForms Type Plugin Vulnerable versions = 1.7.3 Fixed in 1.7.4 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2025-6691 Patch priority High CVSS severity High 8.1 Developer Brainstorm Force PSID d93b2c396300 Credits Phat RiO - BlueRock Required privilege...

Cosmos SDK's Integer Overflow vulnerability in its Validator Rewards pool can cause a chain halt

Description Name: ISA-2025-005: Integer Overflow in Cosmos SDK Component: CosmosSDK Criticality: High Considerable Impact; Likely Likelihood per ACMv1.2 Affected versions: = v0.50.13, = 0.53.2 Affected users: Validators, Full nodes, Users on chains that utilize the distribution module Cosmos SDK...

CVE-2025-49546

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application...

CVE-2025-49546

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Access Control vulnerability that could lead to a partial application denial-of-service. A high-privileged attacker could exploit this vulnerability to partially disrupt the availability of the application...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

CVE-2025-49545

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A high-privilege authenticated attacker can force the application to make arbitrary requests via injection of URLs. Exploitation...

CVE-2025-49541

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...