Available now: 2024 Year in Review

Welcome to Cisco Talos' 2024 Year in Review, available for download now. This report is powered by threat telemetry from over 46 million global devices across 193 countries and regions, amounting to more than 886 billion security events per day. Explore key insights in topics including the top...

WordPress plugin Multi Days Events and Multi Events in One Day Calendar 跨站请求伪造漏洞

WordPress and the WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists in the WordPress...

Citrix Director: Infrastructure Monitoring - Incorrect PVS Site Name displayed

Wen admin checks Director Infrastructure Monitoring Provisioning Service; incorrect PVS Site Name maight be displayed in multi-site environemnts. Director displays the same Site Name and Site ID for all servers from the same PVS Farm and different PVS Sites. You cannot select other correct PVS...

SUSE CVE-2025-25068

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes...

SUSE CVE-2025-30179

Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries...

Overcoming the Challenges of Vulnerability Remediation

The following is a guest blog post by Zac Youtz, Co-Founder and CTO at valued Rapid7 partner, Furl. Here, Zac discusses how to effectively remediate vulnerabilities discovered by Rapid7’s InsightVM. Scaling vulnerability remediation with AI Vulnerability remediation is a crucial-yet-complex task...

Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 (MMSA-2025-00422)

The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, or 10.4.3. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00422 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8 fail to enforce MFA on certain...

Mattermost Server 9.11.x < 9.11.9 / 10.3.x < 10.3.4 / 10.4.x < 10.4.3 / 10.5 (MMSA-2025-00444)

The version of Mattermost Server installed on the remote host is prior to 9.11.9, 10.3.4, 10.4.3, or 10.5. It is, therefore, affected by a vulnerability as referenced in the MMSA-2025-00444 advisory. - Mattermost versions 10.4.x = 10.4.2, 10.3.x = 10.3.3, 9.11.x = 9.11.8, 10.5.x = 10.5.0 fail to...

DEBIAN-CVE-2023-52940

In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lrugenmigratemm assumes lrugenaddmm runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone cgroupcanfork cgroupprocswrite cgrouppostfork tasklock...

UBUNTU-CVE-2023-52940

In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lrugenmigratemm assumes lrugenaddmm runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone cgroupcanfork cgroupprocswrite cgrouppostfork tasklock...

CVE-2023-52940

CVE-2023-52940 affects the Linux kernel; it concerns the multi-gen LRU code during cgroup migration. The issue arises in lru_gen_migrate_mm(), which assumes lru_gen_add_mm() runs before it, but in a specific cross-CPU sequence (clone, cgroup_fork, cgroup_procs_write, cgroup_post_fork, task_lock, ...

CVE-2025-2510

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2025-30118

An issue was discovered on the Audi Universal Traffic Recorder 2.88. It has Susceptibility to denial of service. It uses the same default credentials for all devices and does not implement proper multi-device authentication, allowing attackers to deny the owner access by occupying the only...

GPT Academic Resource Management Error Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a Resource Management Error vulnerability that stems from an excessive number of characters at the end of a multi-part boundary during a file upload that caus...

Exploit for CVE-2025-30208

中文 | English Vite Dev Server Vulnerability...

GO-2025-3551 Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server

Mattermost Fails to Enforce MFA on Plugin Endpoints in github.com/mattermost/mattermost-server...

CVE-2025-2510

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2025-2510 Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2025-2510 Frndzk Expandable Bottom Bar <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via text Parameter

The Frndzk Expandable Bottom Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text' parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-leve...

CVE-2025-2510

CVE-2025-2510 concerns the Frndzk Expandable Bottom Bar plugin for WordPress. The vulnerability is described as a Stored Cross-Site Scripting (XSS) via the text parameter in all versions up to and including 1.0, caused by insufficient input sanitization and output escaping. It states that only au...