CVE-2025-11377 List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attackers, with contributor-level...

CVE-2025-11377

The CVE-2025-11377 case is supported by multiple connected sources: WordPress List category posts plugin 0.92.0) or follow vendor advisories for fixes. Monitor for updates from CVE databases and the plugin maintainers to confirm remediation efficacy.

PT-2025-44703

Name of the Vulnerable Software and Affected Versions WordPress List category posts plugin versions prior to 0.92.0 Description The List category posts plugin for WordPress has an information exposure issue due to insufficient restrictions on posts included by the 'catlist' shortcode. This allows...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Insufficiently Protected Credentials in Requests [CVE-2024-47081]

Summary IBM Watson Speech Services Cartridge is vulnerable to Insufficiently Protected Credentials in Requests, due to a URL parsing issue CVE-2024-47081. Requests is used in our speech runtimes This vulnerabilitiy has been addressed. Please read the details for remediation below. Vulnerability...

CVE-2013-10072 Nagios XI < 2012R1.6 Auto-Discovery Missing Authorization

Nagios XI versions prior to 2012R1.6 contain an authorization flaw in the Auto-Discovery functionality. Users with read-only roles could directly reach Auto-Discovery endpoints and pages that should require elevated permissions, exposing discovery results and allowing unintended access to discove...

FastMCP Auth Integration Allows for Confused Deputy Account Takeover

Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...

Poly Clariti Manager Hard-coded Key Unauthorized Access

The vulnerability of the Poly Clariti Manager platform for managing, planning, and maintaining audio-visual systems is related to the use of a strictly encrypted cryptographic key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected...

AVReg Software Unauthenticated Access Disclosure

The vulnerability of the AVReg software for creating audio/video recorders is related to insufficient testing of server-side requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

ROS-20251029-03

A vulnerability in the tarfile module of the Python programming language is related to incorrect definition of symbolic links during file access. symbolic links during file access. Exploitation of the vulnerability could allow an attacker acting remotely to affect the integrity of protected...

CVE-2025-55752

A directory traversal vulnerability in Apache Tomcat caused by improper URL normalization during request rewriting. When specific rewrite rules are used, an attacker could craft a malicious request to bypass access restrictions and reach protected directories such as /WEB-INF/ or /META-INF/. If...

Jira Align Authorization Bypass

The vulnerability of the cloud-based corporate solution for planning and managing Jira Align formerly AgileCraft is related to deficiencies in the authorization process when performing Edit Checklist items. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

Jira Align Authorization Bypass

The vulnerability of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

Portfolio Room Module Unauthorized Access

The vulnerability of the Portfolio Room module in the cloud corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a malicious actor, operating...

Jira Align Authorization Bypass

The vulnerability of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process when processing audit logs. Exploiting this vulnerability could allow a malicious actor, operating...

Jira Align Unauthorized Access

The vulnerability of the subscription function in the cloud corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a malicious actor, operating...

Jira Align Authorization Bypass

The vulnerability of the cloud-based corporate solution for planning and managing software and IT projects like Jira Align formerly AgileCraft is related to deficiencies in the authorization process during the execution of the “Generate Team Sprints” action. Exploiting this vulnerability could...

External Reports Module Unauthorized Access

The vulnerability of the External Reports module in the cloud corporate solution for planning and managing Jira Align formerly AgileCraft is related to deficiencies in the authorization process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized...

XWiki Platform Skin Skinx Data Compromise

The vulnerability of the org.xwiki.platform:xwiki-platform-skin-skinx component of the XWiki Platform framework is related to errors in processing the relative path to the directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of protected...

Linux e1000ResetTask Heap Buffer Overflow DoS

The vulnerability of the e1000ResetTask function in the Linux operating system is related to latency issues. Exploiting this vulnerability can allow a remote attacker to compromise the accessibility of protected information...

Flowise Authentication Bypass

The vulnerability of the Flowise application development platform lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...