CVE-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...

WordPress WP ERP plugin < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information vulnerability

Custom+ Unauthorized Access to Terminated Employee Information vulnerability discovered by Pedro Cuco Illex in WordPress Plugin WP ERP versions 1.13.4...

CVE-2025-4894

creationtimestamp| type| source ---|---|--- 2025-05-18 20:37:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16777 2025-05-18 21:13:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lphxxhziip2s...

CVE-2025-39507

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through 6.4.4...

CVE-2025-48219

O2 UK before 2025-05-19 allows subscribers to determine the Cell ID of other subscribers by initiating an IMS IP Multimedia Subsystem call and then reading the utran-cell-id-3gpp field of a Cellular-Network-Info SIP header, aka an ECI E-UTRAN Cell Identity leak. The Cell ID might be usable to...

CVE-2025-4872

creationtimestamp| type| source ---|---|--- 2025-05-18 11:29:17+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpgxdo6pnyp2 2025-05-18 13:08:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lph4vedjrj2w 2025-05-19...

CVE-2025-4850

creationtimestamp| type| source ---|---|--- 2025-05-18 03:35:24+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpg4tywhl7b2 2025-05-18 05:08:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpgc2cda7x2v 2025-05-19...

CVE-2025-4838

creationtimestamp| type| source ---|---|--- 2025-05-17 22:18:57+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lpfl5hvcx3j2 2025-05-18 01:13:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpfuvr5wsm2o...

CVE-2025-4919

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...

CVE-2025-4921

Rejected reason: Duplicate of CVE-2025-4919...

CVE-2025-47273

creationtimestamp| type| source ---|---|--- 2025-05-17 17:12:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpf22qx2g72w 2025-05-24 17:50:57+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lpwphn64oc2g 2025-05-24 20:27:37+00:00| seen|...

CVE-2025-47273

CVE-2025-47273 affects setuptools by a path traversal in PackageIndex prior to 78.1.1, allowing writing files to arbitrary locations with the process’s permissions and potentially enabling remote code execution in context. Affected: setuptools package (Python ecosystem). The issue is fixed in ver...

CVE-2025-4101 MultiVendorX – WooCommerce Multivendor Marketplace Solutions <= 4.2.22 - Incorrect Authorization to Authenticated (Contributor+) Arbitrary Post Deletion

The MultiVendorX – WooCommerce Multivendor Marketplace Solutions plugin for WordPress is vulnerable to unauthorized loss of data due to a misconfigured capability check on the 'deletefpmproduct' function in all versions up to, and including, 4.2.22. This makes it possible for authenticated...

CVE-2025-4824 TOTOLINK A702R/A3002R/A3002RU HTTP POST Request formWsc buffer overflow

A vulnerability classified as critical has been found in TOTOLINK A702R, A3002R and A3002RU 3.0.0-B20230809.1615. This affects an unknown part of the file /boafrm/formWsc of the component HTTP POST Request Handler. The manipulation of the argument submit-url leads to buffer overflow. It is possib...

Security Bulletin: Vulnerability in path-to-regexp affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in path-to-regexp has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-31637

creationtimestamp| type| source ---|---|--- 2025-05-16 18:37:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcodn4l6r2r...

CVE-2025-0130

A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packets that causes the firewall to become unresponsive and eventually reboot. Repeated successful attempts to trigger this...

CVE-2025-47534

Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through = 3.25.0...

CVE-2025-31923

Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through = 3.0...

CVE-2025-40906

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities. Those include CVE-2017-14227, CVE-2018-16790, CVE-2023-0437, CVE-2024-6381, CVE-2024-6383, and CVE-2025-0755. BSON-XS was the official Perl XS implementation of MongoDB's BSON...