PT-2025-39820

Name of the Vulnerable Software and Affected Versions Apt-Cacher-NG version 3.2.1 Description A reflected cross-site scripting XSS issue exists in the web management application. This allows an attacker to execute malicious scripts. The issue is due to improper handling of GET inputs included in...

WordPress Plugin AllInOne - Banner Rotator SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin AllInOne - Banner Rotator suffers from a SQL injection vulnerability, no detai...

CVE-2025-10858

creationtimestamp| type| source ---|---|--- 2025-09-28 21:54:03+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3lzwibdgnic2c 2025-09-29 15:05:53+00:00| seen| https://t.me/techb0ltGenona/5735...

OSV-2025-788 Heap-buffer-overflow in int arrow::bit_util::BitReader::GetBatch<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447480433 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::bitutil::BitReader::GetBatch auto arrow::util::RleBitPackedDecoder::GetBatch std::1::pair arrow::util::R...

Obsidian-framework

Obsidian Framework 🛡️ An advanced, template-driven se...

MAL-2025-48895 Malicious code in netkit-lite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b4f77a4b324adb21fdeb5020c213d4ad7d72eefe9f26ee0c134a1cc8544255e9 Project is intended only for presenting dependency confusion and exfiltrates basic data --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Crash Tests for Security: Why BAS Is Proof of Defense, Not Assumptions

Car makers don’t trust blueprints. They smash prototypes into walls. Again and again. In controlled conditions. Because design specs don’t prove survival. Crash tests do. They separate theory from reality. Cybersecurity is no different. Dashboards overflow with “critical” exposure alerts...

Fedora: Security Advisory (FEDORA-2025-f814c5f499)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 15, 2025 to September 21, 2025)

Calling all Vulnerability Researchers and Bug Bounty Hunters! Operation: Maximum Impact Challenge ! Now through November 10, 2025, earn 2X bounty rewards forall in-scope submissions in software with at least 5,000 active installs and fewer than 5 million active installs. Bounties up to $31,200 pe...

Gcore Radar Report Reveals 41% Surge in DDoS Attack Volumes

Luxembourg, Luxembourg, 25th September 2025, CyberNewsWire...

Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions

When using Claude Code with Yarn installed, Yarn config files can trigger code execution when running yarn --version. This could lead to a bypass of the directory trust dialog in Claude Code, as plugins and yarnPath could be executed prior to the user accepting the risks of working in an untruste...

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Impact v3.1.0, v2.1.3, v1.16.5 and below Patches Has been patched in 3.1.1, 2.1.4, and 1.16.6 Workarounds You can use the ignore option to ignore non files/directories. js ignore , header // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory...

axboe fio init.c __parse_jobs_ini use after free

...

PT-2025-39340

CVE-2025-00456 UNDER DEVELOPMENT - USE AT YOUR OWN RISK!!! Enhanced Incident Summary Report Executive Summary On September 18, 2025, a medium-severity incident Risk Score https://t.co/DGZmVvA9zF...

SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist

Austin, Texas, USA, 23rd September 2025, CyberNewsWire...

WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Passster versions = 4.2.18...

Unbreakable Enterprise kernel security update

5.15.0-312.187.5.3 - HID: core: do not bypass hidhwrawrequest Benjamin Tissoires Orabug: 38454666 CVE-2025-38494 - vsock: Do not allow binding to VMADDRPORTANY Budimir Markovic Orabug: 38454665 CVE-2025-38618 - cloneprivatemnt: make sure that caller has CAPSYSADMIN in the right userns Al Viro...

CVE-2025-56075

A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request...

CVE-2025-10770 jeecgboot JimuReport MySQL JDBC testConnection deserialization

A vulnerability was found in jeecgboot JimuReport up to 2.1.2. This impacts an unknown function of the file /drag/onlDragDataSource/testConnection of the component MySQL JDBC Handler. Performing manipulation results in deserialization. Remote exploitation of the attack is possible. The exploit ha...

CVE-2025-10770

CVE-2025-10770 affects Jeecgboot JimuReport up to version 2.1.2, where deserialization occurs in the MySQL JDBC Handler via an attacker-controlled input in the file path /drag/onlDragDataSource/testConnection. This allows remote code execution; the exploit has been publicly disclosed. The Red Hat...