CVE-2025-61727 vulnerabilities

Vulnerabilities for packages: kube-rbac-proxy, nri-couchbase, splunk-otel-collector, kube-fluentd-operator, grpc-health-probe, kind, kargo, gitea, rootlesskit, mkcert, src, terraform-mcp-server, sftpgo-plugin-eventsearch, gitsign, terraform-docs, opentelemetry-collector-contrib, snyk-cli, ko,...

GHSA-5MH9-3JWC-RP59 vulnerabilities

Vulnerabilities for packages: spire-controller-manager, timescaledb-tune, spiffe-helper-fips, nri-consul, rancher, cloud-provider-azure-fips, cluster-api-aws-controller-fips, metrics-server-fips, kyverno-policy-reporter-ui-fips, kubo-fips, terraform-provider-random-fips, postgres-operator,...

CVE-2025-66558

Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud. Prior to 1.4.2 and 2.4.1, a missing ownership check allowed an attack to take-away a 2FA webauthn device when correctly guessing a 80-128 character long random string of letters, numbers and symbols. The victim would...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, spire-controller-manager, prometheus-postgres-exporter, terraform-provider-azuread-fips, cloudflared-fips, nri-nginx, spiffe-helper-fips, nri-consul, rancher, kubernetes-csi-node-driver-registrar, cloud-provider-azure-fips,...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: docker-credential-acr-env, spire-controller-manager, prometheus-postgres-exporter, terraform-provider-azuread-fips, cloudflared-fips, nri-nginx, spiffe-helper-fips, nri-consul, rancher, kubernetes-csi-node-driver-registrar, cloud-provider-azure-fips,...

wp_exploitation_framework

🚀 WordPress PWN Framework v5.0 - AI-Powered Edition !Python...

CVE-2025-27935 Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication...

CVE-2025-27935 Authentication Bypass in OTP (One-time Passcode) IdP Adapter Integration Kit

The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kargo, src-fingerprint, openbao-k8s, src, newrelic-prometheus-configurator, multus-cni, kubernetes, pulumi-language-dotnet, aactl, gitsign, sftpgo, prometheus-operator, cloud-provider-vsphere, falco-exporter, grpcurl, tofu-controller,...

GHSA-7C64-F9JR-V9H2 vulnerabilities

Vulnerabilities for packages: kube-fluentd-operator, kargo, src-fingerprint, openbao-k8s, src, newrelic-prometheus-configurator, multus-cni, kubernetes, pulumi-language-dotnet, aactl, gitsign, sftpgo, prometheus-operator, cloud-provider-vsphere, falco-exporter, grpcurl, tofu-controller,...

CVE-2022-50335

creationtimestamp| type| source ---|---|--- 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8...

Oracle Linux 9 : openssl (ELSA-2025-21255)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-21255 advisory. 3.5.1-4.0.1 - Enable openssl-fips-provider dependency Orabug: 36504822 - Temporary disable openssl-fips-provider dependency Orabug: 36504822 - Replace upstream...

openssl security update

3.5.1-4.0.1 - Enable openssl-fips-provider dependency Orabug: 36504822 - Temporary disable openssl-fips-provider dependency Orabug: 36504822 - Replace upstream references Orabug: 34340177 3.5.1.openela.0.1 - Add OpenELA specific changes 1:3.5.1-4 - Fix CVE-2025-9230 Resolves: RHEL-115929 1:3.5.1-...

CVE-2025-12419

Mattermost versions 10.12.x = 10.12.1, 10.11.x = 10.11.4, 10.5.x = 10.5.12, 11.0.x = 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of...

CVE-2025-65238

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information...

CVE-2025-65235

OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function...

AI Inference at the Edge: How Akamai’s Evolution Made It Possible

Read how Akamai, a pioneer in CDNs, is undergoing a profound strategic transformation into a diversified cloud and cybersecurity provider in the AI era...

EUVD-2025-199726

Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information...

Qilin Ransomware Turns South Korean MSP Breach Into 28-Victim 'Korean Leaks' Data Heist

South Korea's financial sector has been targeted by what has been described as a sophisticated supply chain attack that led to the deployment of Qilin ransomware. "This operation combined the capabilities of a major Ransomware-as-a-Service RaaS group, Qilin, with potential involvement from North...

CVE-2025-64066

Primakon Pi Portal 1.0.18 REST /api/v2/user/register endpoint suffers from a Broken Access Control vulnerability. The endpoint fails to implement any authorization checks, allowing unauthenticated attackers to perform POST requests to register new user accounts in the application's local database...