CVE-2025-68920

creationtimestamp| type| source ---|---|--- 2025-12-24 22:27:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3marcovotch2r 2025-12-24 22:34:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mard45ok7h27...

CVE-2018-25148

creationtimestamp| type| source ---|---|--- 2025-12-24 21:11:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mar6hrwhbi2m 2025-12-24 21:48:57+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3marakbvwng27...

CVE-2021-47721

creationtimestamp| type| source ---|---|--- 2025-12-23 21:12:15+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3maonzqnfgc2p 2025-12-23 21:16:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maoobg5aja2c...

CVE-2023-53982

creationtimestamp| type| source ---|---|--- 2025-12-23 20:45:16+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3maomjikrto2f 2025-12-23 21:31:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maop4bgoai2g...

CVE-2025-29229

creationtimestamp| type| source ---|---|--- 2025-12-23 18:28:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maoeurwrq22y 2025-12-23 19:05:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3maogwatm7u2u...

PT-2025-52548

Name of the Vulnerable Software and Affected Versions Ultimate Member plugin for WordPress versions prior to 2.11.1 Description The Ultimate Member plugin for WordPress is affected by a sensitive information exposure issue. Insufficient authorization checks on an unauthenticated AJAX endpoint,...

CVE-2025-14733

creationtimestamp| type| source ---|---|--- 2025-12-19 01:35:52+00:00| seen| https://infosec.exchange/users/offseq/statuses/115743663755552892 2025-12-19 01:35:53+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mackgko76e2g 2025-12-19 08:02:37+00:00| exploited|...

CVE-2025-68435

creationtimestamp| type| source ---|---|--- 2025-12-18 00:05:41+00:00| seen| https://infosec.exchange/users/offseq/statuses/115737646820820278 2025-12-18 00:05:42+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ma7uweooql2f 2025-12-18 01:44:31+00:00| seen|...

CVE-2023-53905 ProjectSend r1605 CSV Injection via User Account Export Functionality

ProjectSend r1605 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into user profile names. Attackers can craft payloads like =calc|a!z| in the name field to trigger code execution when administrators export action logs as CSV files...

EUVD-2025-203923

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input...

CVE-2025-13217

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the YouTube Video 'value' field in all versions up to, and including, 2.11.0. This is due to insufficient input...

The US digital doxxing of H-1B applicants is a massive privacy misstep

Technology professionals hoping to come and work in the US face a new privacy concern. Starting December 15, skilled workers on H-1B visas and their families must flip their social media profiles to public before their consular interviews. It’s a deeply risky move from a security and privacy...

CVE-2025-66474

The CVE-2025-66474 entry concerns XWiki Rendering. Affected: XWiki Rendering versions 16.10.9 and earlier, 17.0.0-rc-1 through 17.4.2, and 17.5.0-rc-1 through 17.5.0. Root cause: insufficient protection against {{/html}} injection, enabling attackers who can edit a profile or any document to exec...

Spiderman Phishing Kit Targets European Banks with Real-Time Credential Theft

Varonis threat analysts warn about Spiderman, a dangerous new kit that automates attacks against European banks and crypto customers, stealing a victim’s full identity profile...

CVE-2022-47425 WordPress ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin <= 3.4.10 - Broken Access Control

Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a through 3.4.10...

CVE-2022-47425

ARMember for WordPress

CVE-2025-22420

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-22420

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CERTFR-2025-ACT-054

creationtimestamp| type| source ---|---|--- 2025-12-08 13:34:12+00:00| seen| https://bsky.app/profile/cert-fr.bsky.social/post/3m7i5gw5sie23 2025-12-08 13:34:13+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/115684203023191377 2025-12-08 14:44:49+00:00| seen|...

Scammers harvesting Facebook photos to stage fake kidnappings, warns FBI

The FBI has warned about a new type of scam where your Facebook pictures are harvested to act as “proof-of-life” pictures in a virtual kidnapping. The scammers pretend they have kidnapped somebody and contact friends and next of kin to demand a ransom for their release. While the alleged victim i...