CVE-2025-12621

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

CVE-2025-12621

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

CVE-2025-12621

Insight (CVE-2025-12621) The WordPress plugin “Flexible Refund and Return Order for WooCommerce” is vulnerable via an incorrect/misconfigured capability check in the create_refund function, allowing any authenticated user with Contributor level or higher to modify refund statuses (approve/deny) i...

CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

CVE-2025-12621 Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'createrefund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, wit...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization. An attacker can disrupt control over a running virtual machine instance by creating a pod with identical labels to the legitimate virt-launcher pod, misleading the controller into associating the fake pod with t...

CVE-2025-64435

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can...

GHSA-W832-GG5G-X44M

creationtimestamp| type| source ---|---|--- 2025-11-07 20:58:17+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115510417640999900 2025-11-10 09:28:07+00:00| seen| https://gist.github.com/Ochyro/47b7b222c6ca5445d317dbcf46c47d39...

GHSA-PQHF-P39G-3X64

creationtimestamp| type| source ---|---|--- 2025-11-07 20:31:33+00:00| seen| https://gist.github.com/EbonJaeger/f7d172d49605e41a6829980152c0f6d1...

CVE-2025-63585

OSSN Open Source Social Network 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter...

Exploit for CVE-2025-63585

CVE-2025-63585 Blind Time-Based SQL Injection in /action/rtc...

CVE-2025-12789

creationtimestamp| type| source ---|---|--- 2025-11-07 00:41:36+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m4ytrncavwn2 2025-11-07 02:18:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m4yz7jol3j2k...

kernel: Fix of 6 CVEs

fix: virtio-net: Add validation for used length CVE-2021-47352 - xen/netfront: don't use gnttabqueryforeignaccess for mapped status CVE-2022-23037 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - net: fix information leakage in /proc/net/ptype CVE-2022-48757 - net: atm:...

CLSA-2025-1762454401 kernel: Fix of 6 CVEs

fix: virtio-net: Add validation for used length CVE-2021-47352 - xen/netfront: don't use gnttabqueryforeignaccess for mapped status CVE-2022-23037 - net/sched: schqfq: Fix race condition on qfqaggregate CVE-2025-38477 - net: fix information leakage in /proc/net/ptype CVE-2022-48757 - net: atm:...

CVE-2025-27917

creationtimestamp| type| source ---|---|--- 2025-11-06 17:28:49+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115503931619214286...

GHSA-Q754-4PC2-WJQW

creationtimestamp| type| source ---|---|--- 2025-11-06 15:07:25+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115503375634049442...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990584)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990584 advisory. In the Linux kernel, the following vulnerability has been resolved: MIPS: Octeon: Add PCIe link status check The standard PCIe configuration read-write interface is...