PT-2025-51009

Name of the Vulnerable Software and Affected Versions macOS versions prior to Sonoma 14.8.3 macOS versions prior to Sequoia 15.7.3 Description A flaw allowed an application to potentially access sensitive location data. The vulnerable code has been removed in updated versions. Recommendations...

PT-2025-50926

The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accessible directory with predictable filenames in all versions up to, and including, 4.9.2. This makes it possible for...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS Sonoma prior to 14.8.3 and Sequoia prior to 15.7.3, which stems from a permissions issue that could result in reading sensitive...

CVE-2025-43513: Improper Access Control

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able to read sensitive location information...

WordPress plugin Events Manager 信息泄露漏洞

WordPress Events Manager Plugin is a full-featured open source plugin designed for managing events on WordPress sites. WordPress Events Manager Plugin suffers from an information disclosure vulnerability that stems from an under-restricted getlocation operation, which can be exploited by an...

CVE-2025-67780

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 e.g., on Mini1prod2 allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation,...

PT-2025-50774

Name of the Vulnerable Software and Affected Versions SpaceX Starlink Dish versions 2024.12.04.mr46620 Description SpaceX Starlink Dish devices allow administrative actions via unauthenticated LAN gRPC requests, referred to as MARMALADE 2. The cross-origin policy can be bypassed by omitting a...

CVE-2025-67780: Missing Authentication for Critical Function

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 e.g., on Mini1prod2 allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation,...

(0Day) PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability. The specific flaw exists within the...

(0Day) Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Soda PDF Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration o...

ECHO-8BA3-E338-1667 Kernel vulnerabilities are irrelevant in container environments.

Bulletin has no description...

MINI-C9Q9-8442-RF8X

Bulletin has no description...

CGA-W5M9-9WXJ-CF3Q

Bulletin has no description...

CGA-VJ6P-22CM-WPGH

Bulletin has no description...

MINI-87GQ-6XM3-XFFC

Bulletin has no description...

CVE-2025-14134

creationtimestamp| type| source ---|---|--- 2025-12-06 14:55:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m7dazzn5mx2q 2025-12-07 09:10:07+00:00| seen| https://bsky.app/profile/blackwiremedia.bsky.social/post/3m7f67qi4li2r...

MINI-P475-Q6CJ-F79W

Bulletin has no description...

EUVD-2025-201342

The SSP Debug plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.0. This is due to the plugin storing PHP error logs in a predictable, web-accessible location wp-content/uploads/ssp-debug/ssp-debug.log without any access controls. This...

MINI-4MVX-GFHW-2FQQ

Bulletin has no description...

GFI KerioControl < 9.4.5 HTTP Response Splitting

GFI KerioControl version prior to 9.4.5 is affected by an HTTP Response Splitting vulnerability. Due to a not properly sanitized GET parameter used to generate a Location HTTP header in a 302 HTTP response an attacker can exploit this vulnerability to perform an Open Redirect or HTTP Response...