BELL-CVE-2025-38102

Bulletin has no description...

CVE-2025-53370 Citizen stored XSS vulnerability through short descriptions

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page...

CVE-2025-53368 Citizen is vulnerable to stored XSS attack in the legacy search bar

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert...

WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability

Broken Authentication Vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WP Compress versions = 6.30.30...

CVE-2025-40723

CVE-2025-40723 affects Flatboard Pro (Flatboard) versions prior to 3.2.2. The vulnerability is a Stored Cross-Site Scripting (XSS) due to insufficient validation of user input, exploitable through the footer_text and announcement parameters in config.php. Remediation: upgrade to 3.2.2 or later. A...

BELL-CVE-2025-4575

Bulletin has no description...

CVE-2025-38157 wifi: ath9k_htc: Abort software beacon handling if disabled

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: Abort software beacon handling if disabled A malicious USB device can send a WMISWBAEVENTID event from an ath9khtc-managed device before beaconing has been enabled. This causes a device-by-zero error in the driver...

Cross-site Scripting (XSS)

github.com/gogs/gogs is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the inclusion of an outdated version of pdfjs v1.4.20 that allows client-side JavaScript execution...

BELL-CVE-2025-38092

Bulletin has no description...

PT-2025-27788

Name of the Vulnerable Software and Affected Versions: VNC affected versions not specified Description: The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. Recommendations: At the moment,...

PT-2025-27795 · Publishpress · Publishpress Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: PublishPress Gutenberg Blocks versions 3.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacke...

PT-2025-27827 · Pi-Hole · Pi-Hole

Name of the Vulnerable Software and Affected Versions: Pi-hole versions up to 3.3 Description: An authenticated command injection issue exists, allowing an attacker to append OS commands to the domain string when adding a domain to the allowlist via the web interface. These commands are executed ...

CVE-2025-52891 ModSecurity empty XML tag causes segmentation fault

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

GHSA-3M86-C9X3-VWM9

creationtimestamp| type| source ---|---|--- 2025-07-02 14:54:26+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114784211147922979...

Integrity Validation Bypass

Electron is vulnerable to Integrity Validation Bypass. The vulnerability is due to insufficient enforcement of ASAR integrity and loading restrictions due to reliance on embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses, which can be bypassed when apps are launched from...

MAL-2025-6529 Malicious code in jirawrapped (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 22cb10a2f4a514eac4296e09281b5b08784e62d6616a520e032e563d69a0e6e1 During installation, the package attempts to exfiltrate browser history --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

RHSA-2025:10118 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update

Bulletin has no description...

CVE-2025-24334

The Nokia Single RAN baseband software earlier than 23R2-SR 1.0 MP can be made to reveal the exact software release version by sending a specific HTTP POST request through the Mobile Network Operator MNO internal RAN management network...

CVE-2025-24329

Sending a crafted SOAP "provision" operation message archive field within the Mobile Network Operator MNO internal Radio Access Network RAN management network can cause path traversal issue in Nokia Single RAN baseband software with versions earlier than release 24R1-SR 1.0 MP. This issue has bee...

CVE-2025-24328 OAM service stack overflow caused by crafted SOAP message within the MNO internal RAN management network

Sending a crafted SOAP "set" operation message within the Mobile Network Operator MNO internal Radio Access Network RAN management network can cause Nokia Single RAN baseband OAM service component restart with software versions earlier than release 24R1-SR 1.0 MP. This issue has been corrected to...