CVE-2025-15469

Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of an error. Impact summary: A user signing or verifying files larger than 16MB with one-shot algorithms such as Ed25519, Ed448, or ML-DSA m...

CVE-2020-36941 Knockpy 4.1.1 - CSV Injection

Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...

CVE-2020-36941

Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...

CVE-2020-36941

Knockpy 4.1.1 is vulnerable to a CSV injection due to unfiltered server headers, enabling malicious spreadsheet formulas to be injected into CSV reports and potentially execute when opened in spreadsheet apps. The issue is confirmed with CVSS v3.1/4.0 data indicating a high impact (base score 9.8...

CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The...

CVE-2026-24490 MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field

MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting XSS vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session by uploading a malicious APK. The...

PT-2026-4923

Knockpy 4.1.1 contains a CSV injection vulnerability that allows attackers to inject malicious formulas into CSV reports through unfiltered server headers. Attackers can manipulate server response headers to include spreadsheet formulas that will execute when the CSV is opened in spreadsheet...

Cross-site Scripting (XSS)

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Cross-site...

BIT-MOODLE-2025-32045 Moodle: hidden grades shown to users without permission on some grade reports

A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades...

POC-Generator-Burp_Suite_Extension

🎯 POC Generator - Burp Suite Extension From vulnerability...

Wordfence Bug Bounty Program Monthly Report – December 2025

Last month in December 2025, the Wordfence Bug Bounty Program received 759 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfen...

GHSA-FPHV-W9FQ-2525 vulnerabilities

Vulnerabilities for packages: witness, sigstore-scaffolding-fips, trivy-operator, chainctl, spire-server, rekor-fips, crossplane, cloudbeat-fips, slsa-verifier, neuvector-sigstore-interface, kyverno, kubescape, flux-source-controller, vexctl, teleport, tflint-fips, goreleaser,...

CVE-2026-23992 vulnerabilities

Vulnerabilities for packages: witness, sigstore-scaffolding-fips, trivy-operator, chainctl, spire-server, rekor-fips, crossplane, cloudbeat-fips, slsa-verifier, neuvector-sigstore-interface, kyverno, kubescape, flux-source-controller, vexctl, teleport, tflint-fips, goreleaser,...

CVE-2026-23991 vulnerabilities

Vulnerabilities for packages: witness, sigstore-scaffolding-fips, trivy-operator, chainctl, spire-server, rekor-fips, crossplane, cloudbeat-fips, slsa-verifier, neuvector-sigstore-interface, kyverno, kubescape, flux-source-controller, vexctl, teleport, tflint-fips, goreleaser,...

GHSA-846P-JG2W-W324 vulnerabilities

Vulnerabilities for packages: witness, sigstore-scaffolding-fips, trivy-operator, chainctl, spire-server, rekor-fips, crossplane, cloudbeat-fips, slsa-verifier, neuvector-sigstore-interface, kyverno, kubescape, flux-source-controller, vexctl, teleport, tflint-fips, goreleaser,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-004889)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004889 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix memory leak in hidrawrelease Free the buffered reports before deleting the list...

Wordfence Intelligence Weekly WordPress Vulnerability Report (January 12, 2026 to January 18, 2026)

Did you know Wordfence runs aBug Bounty Program for all WordPress plugin and themes at no cost to vendors? Researchers can earn up to $31,200 per vulnerability , for all in-scope vulnerabilities submitted to our Bug Bounty Program! Find a vulnerability, submit the details directly to us, and we...

RHSA-2026:0934

creationtimestamp| type| source ---|---|--- 2026-01-22 07:17:18+00:00| seen| Telegram/lGv1yy1cS3Qd5QcSfBz2heRy30BQbqauAGACazKYMQPWz0 2026-01-22 07:17:33+00:00| seen| Telegram/tBmM1hwypCv-VLMpuj8Kze67Wi8ihsn5KG2dbjWdD4A-1M 2026-01-22 07:17:54+00:00| seen|...

CVE-2026-23946 Tendenci has Authenticated Remote Code Execution via Pickle Deserialization

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module which is not enabled by default. This vulnerability allows Remote Code Execution RCE b...

Oracle Primavera Unifier (January 2026 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Apache Tika. Supported versions th...