WordPress plugin Nextend Social Login and Register 跨站请求伪造漏洞

WordPress Nextend Social Login and Register plugin is a free WordPress plugin designed to simplify the registration and login process for website users. A cross-site request forgery vulnerability exists in the WordPress Nextend Social Login and Register plugin, which arises from a web application...

Google Chrome < 4.8.271.17 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 4.8.271.17. It is, therefore, affected by multiple vulnerabilities as referenced in the 201601stable-channel-update20 advisory. - Multiple unspecified vulnerabilities in Google Chrome before 48.0.2564.82 allow attackers...

CVE-2025-13132 Dia: Increased Spoof Risk; Missing full screen toast

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

WordPress Like-it plugin cross-site request forgery vulnerability

WordPress Like-it plugin is an extension to add like-it functionality to WordPress blogs, allowing users to perform like-it operations on posts or comments. The WordPress Like-it plugin suffers from a cross-site request forgery vulnerability, which arises from a web application that does not...

CVE-2025-51663

A vulnerability found in IPRateLimit implementation of FileCodeBox up to 2.2 allows remote attackers to bypass ip-based rate limit protection and failed attempt restrictions by faking X-Real-IP and X-Forwarded-For HTTP headers. This can enable attackers to perform DoS attacks or brute force share...

CVE-2025-62406

Summary: CVE-2025-62406 affects Piwigo. In version 15.6.0, the password-reset URL is constructed using the request Host header without validation, allowing an attacker who knows or guesses a username/email to send a password-reset link with a modified hostname to a target user. This could enable ...

WordPress WP Manager plugin cross-site request forgery vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site request forgery vulnerability exists in the WordPress WP Manager plugin, which arises from a web application that does not adequately validate that a request is...

WordPress Asgaros Forum plugin cross-site request forgery vulnerability

WordPress Asgaros Forum plugin is a lightweight forum plugin designed for WordPress that supports the rapid creation and management of forum pages, providing basic posting, replying, user management and other functions. The WordPress Asgaros Forum plugin suffers from a cross-site request forgery...

bind: Cache poisoning due to weak PRNG

A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...

kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTCCTRLRSVDSVC and should not be...

MAL-2025-102143 Malicious code in envious_vulture-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a879aa1065a4a8b4a9fa31e261c67dde9d73680d49d4b0a9c63b2e87e59085c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108977 Malicious code in spatial_jellyfish_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73181495ac6485bf5a524aa291963d1bc43dcbf9a7aaccd004c01507ff8d66a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85187 Malicious code in erwin-kue79-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e2d0456ae9783763f00a5e404afc91113cdb2ff6cc8eb6735818f09feb7e02d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69372 Malicious code in metropolitan-scarlet-spider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12eee3024a08c95ee22550b3355e2fdf93fbd89b028656a0ff53a894aa10c6d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in applicable-azure-stoat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 612dd78c4e565ba3b918adb5844d7603f4315e178cef5f85797a5b010e134d06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2025-64435

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

Malicious code in utomo-sambalado52-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da4cf37ea06109e4ee6fdeced5b5bf02abd4b7d27d24140c7dcff08c17ed858c The package utomo-sambalado52-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

bind: Cache poisoning due to weak PRNG

A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...

AZL-69802 CVE-2025-64435 affecting package kubevirt for versions less than 1.6.3-1

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

AZL-69964 CVE-2025-64435 affecting package kubevirt for versions less than 0.59.0-33

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...