CVE-2025-62893

...

CVE-2025-62893

CVE-2025-62893 (mode C): The connected Red Hat and EUVD/EUV sources describe an Authorization Bypass Through a User-Controlled Key in the Mediavine Create by Mediavine mediavine-create plugin. The affected version range is from n/a through 1.9.14. The root cause is a misconfigured access control ...

CVE-2025-60982: Improper Access Control

IDOR vulnerability in Educare ERP 1.0 2025-04-22 allows unauthorized access to sensitive data via manipulated object references. Affected endpoints do not enforce proper authorization checks, allowing authenticated users to access or modify data belonging to other users by changing object...

WordPress Tutor LMS Pro plugin <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to View/Edit Other Assignments vulnerability discovered by sergioframi in WordPress Plugin Tutor LMS Pro versions = 3.8.3...

Naviga Global GN4 Publishing System 安全漏洞

Naviga Global GN4 Publishing System is a content management and publishing system from Naviga Global, USA. A security vulnerability exists in Naviga Global GN4 Publishing System versions prior to 2.6, which stems from an insecure direct object reference in the API that could lead to account...

Vulnerabilities fixed in Oracle Communications products

Oracle has fixed several vulnerabilities in its Communications products, including Unified Assurance and Cloud Native Core. The vulnerabilities in Oracle Communications products allow malicious actors to gain unauthorized access, which can lead to partial or full Denial-of-Service DoS attacks...

CVE-2025-49952 WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through = 4.2.5...

CVE-2025-49952

CVE-2025-49952 affects the WordPress plugin/theme Houzez (WordPress theme by favethemes) up to version 4.1.1. The issue is an authorization bypass caused by incorrectly configured access control, described as a user-controlled key that enables bypassing access restrictions (an insecure direct obj...

CVE-2022-50574

In the Linux kernel, the following vulnerability has been resolved: drm/omap: dss: Fix refcount leak bugs In dssinitports and dssuninitports, we should call ofnodeput for the reference returned by ofgraphgetportbyid in fail path or when it is not used anymore...

WordPress All in One Time Clock Lite plugin <= 2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Clocking In/Out vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Arbitrary Clocking In/Out vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin All in One Time Clock Lite versions = 2.0...

CVE-2025-34282

ThingsBoard versions 4.2.1 contain a server-side request forgery SSRF vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may...

CVE-2025-40007 netfs: fix reference leak

In the Linux kernel, the following vulnerability has been resolved: netfs: fix reference leak Commit 20d72b00ca81 "netfs: Fix the request's work item to not require a ref" modified netfsallocrequest to initialize the reference counter to 2 instead of 1. The rationale was that the requet's "work"...

WordPress Image optimization service by Optimole plugin <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload vulnerability

Insecure Direct Object Reference to Authenticated Author+ Media Offload vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Optimole versions = 4.1.0...

Linux Distros Unpatched Vulnerability : CVE-2025-61908

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga 2 is an open source monitoring system. From 2.10.0 to before 2.15.1, 2.14.7, and 2.13.13, when creating an invalid reference, such as a reference to null...

WordPress Binary MLM Plan plugin <= 5.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Binary MLM Plan versions = 5.0...

CVE-2025-9559

Pega Platform versions 8.7.5 to Infinity 24.2.2 are affected by a Insecure Direct Object Reference issue in a user interface component that can only be used to read data...

PT-2025-42550

Name of the Vulnerable Software and Affected Versions Envoy versions prior to 1.36.2 Envoy versions prior to 1.35.6 Envoy versions prior to 1.34.10 Envoy versions prior to 1.33.12 Description Envoy, an open source edge and service proxy, has a memory safety issue in the Lua filter. When a Lua...

PT-2025-42391

Name of the Vulnerable Software and Affected Versions happy-dom versions prior to 20.0.2 Description The software does not sufficiently isolate untrusted JavaScript, even when using the --disallow-code-generation-from-strings flag. The untrusted script and the main application share the same...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: fix use-after-free in stateshow CVE-2025-39877 In the Linux kernel, the following vulnerability has been resolved: libceph: fix invalid accesses to cephconnectionv1info CVE-2025-39880 In the Linux...

Liferay Portal和Liferay DXP 安全漏洞

Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...