4825 matches found
Turning threat reports into detection insights with AI
Security teams routinely need to transform unstructured threat knowledge, such as incident narratives, red team breach-path writeups, threat actor profiles, and public reports into concrete defensive action. The early stages of that work are often the slowest. These include extracting tactics,...
CVE-2025-33219
creationtimestamp| type| source ---|---|--- 2026-01-28 19:01:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdixipq3su2a 2026-01-28 19:51:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdj2c7v2io2r...
CVE-2025-59900 Authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server
Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting XSS vulnerability. An attacker could send malicious content to an authenticated user and steal information from their session due to insufficient validation of user...
CVE-2025-59900
CVE-2025-59900 describes a persistent authenticated Cross-Site Scripting (XSS) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. Root cause: insufficient validation of user input in the request path related to server options, specifically in “/server_opti...
CVE-2026-24490
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The...
Discourse security vulnerabilities
Discourse is an open-source community discussion platform developed by Discourse. This platform includes features such as communities, email communication, and chat rooms. Vulnerabilities exist in versions of Discourse prior to 3.5.4, as well as versions before 2025.11.2, 2025.12.1, and 2026.1.0...
CVE-2025-15469
Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...
CVE-2020-36941 Knockpy 4.1.1 - CSV Injection
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...
CVE-2020-36941
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...
CVE-2020-36941
Knockpy 4.1.1 is vulnerable to a CSV injection due to unfiltered server headers, enabling malicious spreadsheet formulas to be injected into CSV reports and potentially execute when opened in spreadsheet apps. The issue is confirmed with CVSS v3.1/4.0 data indicating a high impact (base score 9.8...
CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The...
CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The...
PT-2026-4923
Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...
Cross-site Scripting (XSS)
Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Cross-site...
BIT-MOODLE-2025-32045 Moodle: hidden grades shown to users without permission on some grade reports
A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades...
POC-Generator-Burp_Suite_Extension
🎯 POC Generator - Burp Suite Extension From vulnerability...
Wordfence Bug Bounty Program Monthly Report – December 2025
Last month in December 2025, the Wordfence Bug Bounty Program received 759 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfen...
GHSA-FPHV-W9FQ-2525 vulnerabilities
Vulnerabilities for packages: goreleaser, buildkitd, cosign-fips, teleport, rekor, gitsign, image-factory-fips, ratify-fips, ko-fips, kyverno-policy-reporter-plugins-kyverno, sigstore-scaffolding, skaffold, slsa-verifier, trivy-operator, crossplane-fips, trivy-fips, rekor-fips, aactl, docker,...
CVE-2026-23992 vulnerabilities
Vulnerabilities for packages: goreleaser, buildkitd, cosign-fips, teleport, rekor, gitsign, image-factory-fips, ratify-fips, ko-fips, kyverno-policy-reporter-plugins-kyverno, sigstore-scaffolding, skaffold, slsa-verifier, trivy-operator, crossplane-fips, trivy-fips, rekor-fips, aactl, docker,...