CVE-2025-14758

The CVE-2025-14758 entry concerns the YAOOK Operator’s infra-operator, where a misconfiguration in the replication security of the MariaDB component could allow an on-path attacker to read database contents, potentially including credentials. This is documented across multiple feeds (NVD, Red Hat...

WordPress plugin FileBird Pro 安全漏洞

WordPress FileBird Pro plugin is a media library management plugin for WordPress websites designed to help users organize and manipulate media files more efficiently. A missing authorization vulnerability exists in WordPress FileBird Pro plugin, which can be exploited by an attacker to leverage a...

PT-2025-51440

Name of the Vulnerable Software and Affected Versions Barn2 Plugins Document Library Lite versions through 1.1.7 Description An authorization bypass exists due to incorrectly configured access control security levels in Barn2 Plugins Document Library Lite. This allows for unauthorized access. The...

PT-2025-51409

Name of the Vulnerable Software and Affected Versions CatFolders versions through 2.5.3 Description An authorization issue exists in CatFolders that allows exploitation of incorrectly configured access control security levels. Recommendations Update to a version later than 2.5.3...

PT-2025-51467

Name of the Vulnerable Software and Affected Versions Merkulove Huger for Elementor versions through 1.1.5 Description The software contains a missing authorization issue due to incorrectly configured access control security levels. Recommendations Update Merkulove Huger for Elementor to a versio...

PT-2025-51347

Name of the Vulnerable Software and Affected Versions YAOOK Operator affected versions not specified Description An incorrect configuration of replication security within the MariaDB component of the infra-operator in YAOOK Operator could allow an on-path attacker to read database contents, which...

PT-2025-51410

Name of the Vulnerable Software and Affected Versions SiteGround Security versions through 1.5.8 Description A missing authorization issue exists in SiteGround Security sg-security, allowing exploitation due to incorrectly configured access control security levels. Recommendations Update SiteGrou...

PT-2025-51438

Name of the Vulnerable Software and Affected Versions Bob Watu Quiz versions through 3.4.5 Description An authorization issue exists in Bob Watu Quiz, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized access. Recommendations Update Bob Watu...

PT-2025-51464

Name of the Vulnerable Software and Affected Versions Merkulove Buttoner for Elementor versions through 1.0.6 Description An incorrect access control configuration exists in Merkulove Buttoner for Elementor. This allows exploitation due to missing authorization. Recommendations Update Merkulove...

PT-2025-51422

Name of the Vulnerable Software and Affected Versions NinjaTeam FileBird Pro versions through 6.4.9 Description An authorization issue exists in NinjaTeam FileBird Pro filebird-pro, stemming from incorrectly configured access control security levels. This allows for exploitation of the system...

PT-2025-51391

Name of the Vulnerable Software and Affected Versions e-plugins Directory Pro versions through 2.5.6 Description An authorization issue exists in e-plugins Directory Pro. The problem stems from incorrectly configured access control security levels, potentially allowing unauthorized access...

GO-2025-4167 Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium

Cilium with misconfigured toGroups in policies can lead to unrestricted egress traffic in Ciliumgithub.com/cilium/cilium...

GO-2025-4236 Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider

Finality Provider vulnerable to anti-slashing bypassing due to misconfiguration in github.com/babylonlabs-io/finality-provider...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via the misconfiguration of the internal proxy component. An attacker can gain unauthorized cluster administrator privileges by sending crafted commands through the internal proxy...

GHSA-CC8C-28GJ-PX38 Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

Misconfigured Internal Proxy in runtimes-inventory-rhel8-operator Grants Standard Users Full Cluster Administrator Access

A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...

CVE-2025-14038

EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to certain gRPC endpoints. This flaw has been...