CVE-2025-37746

In the Linux kernel, the following vulnerability has been resolved: perf/dwcpcie: fix duplicate pcidev devices During platformdeviceregister, wrongly using struct device pcidev as platformdata caused a kmemdup copy of pcidev. Worse still, accessing the duplicated device leads to list corruption a...

CVE-2025-37742

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount function syzbot reports that hexdumptobuffer is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in...

CVE-2025-3503

creationtimestamp| type| source ---|---|--- 2025-05-01 06:13:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14239 2025-05-01 09:55:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo426aydww2p 2025-05-01 10:39:11+00:00| seen|...

CVE-2025-3504

creationtimestamp| type| source ---|---|--- 2025-05-01 06:13:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14238 2025-05-01 09:55:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo426b7bib2r 2025-05-01 10:39:08+00:00| seen| https://t.me/cvedetector/24194...

CVE-2025-1305

The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorrect nonce validation on the newsbloggerinstallandactivateplugin function. This makes it possible for unauthenticated attackers to upload...

CVE-2025-2816

The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the yellowmessagedontshow function in versions 2.8.0 to 2.8.4. This makes it possible for authenticated attackers, with...

CVE-2025-4146

creationtimestamp| type| source ---|---|--- 2025-05-01 02:14:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14214 2025-05-01 03:48:36+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114430529763357297 2025-05-01 04:00:52+00:00|...

CVE-2025-46629

CVE-2025-46629 affects Tenda RX2 Pro (firmware 16.03.30.14). The issue is a lack of access controls in the 'ate' management binary, enabling an unauthenticated remote attacker to perform unauthorized configuration changes on any router where 'ate' is enabled by sending a crafted UDP packet. The a...

CVE-2024-30146 HCL Domino Leap is affected by improper access control

Improper access control of endpoint in HCL Domino Leap allows certain admin users to import applications from the server's filesystem...

CVE-2022-42449

Unsafe default file type filter policy in HCL Domino Volt allows upload of .html file and execution of unsafe JavaScript in deployed applications...

WordPress Page View Count plugin 2.8.0-2.8.4 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update

Missing Authorization to Authenticated Subscriber+ Limited Options Update vulnerability discovered by kr0d in WordPress Plugin Page View Count versions 2.8.0-2.8.4...

CVE-2025-46554 XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint...

CVE-2025-24091

An app could impersonate system notifications. Sensitive notifications now require restricted entitlements. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.3. An app may be able to cause a denial-of-service...

CVE-2025-30390 Azure ML Compute Elevation of Privilege Vulnerability

...

CVE-2025-32974

creationtimestamp| type| source ---|---|--- 2025-04-30 15:48:37+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114427698650906062 2025-04-30 16:30:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo27ru3j5p2h 2025-04-30 17:32:01+00:00| seen|...

CVE-2025-32376

Discourse is an open-source discussion platform. Prior to versions 3.4.3 on the stable branch and 3.5.0.beta3 on the beta branch, the users limit for a DM can be bypassed, thus giving the ability to potentially create a DM with every user from a site in it. This issue has been patched in stable...

CVE-2025-4115

creationtimestamp| type| source ---|---|--- 2025-04-30 13:13:42+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14029 2025-04-30 13:48:42+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114427227091111449 2025-04-30 15:31:40+00:00| seen|...

CVE-2025-24338

creationtimestamp| type| source ---|---|--- 2025-04-30 11:13:17+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14005 2025-04-30 13:31:04+00:00| published-proof-of-concept| Telegram/ZMJS5w1XZ2iVn41-DRp0jBJzL5A1-4Dr49XSwoANaTKxMXI 2025-04-30 13:55:27+00:00| seen|...

CVE-2025-4016

A vulnerability classified as critical has been found in 20120630 Novel-Plus up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160. This affects the function deleteIndex of the file novel-admin/src/main/java/com/java2nb/common/controller/LogController.java. The manipulation leads to improper...

CVE-2025-4125

creationtimestamp| type| source ---|---|--- 2025-04-30 10:00:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnzjxxfrut2r 2025-04-30 12:03:33+00:00| seen| https://t.me/cvedetector/24074 2025-04-30 13:13:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/14022...