EUVD-2025-11680

Malicious code in bioql PyPI...

EUVD-2023-29958

Malicious code in bioql PyPI...

ICE Wants to Build Out a 24/7 Social Media Surveillance Team

Documents show that ICE plans to hire dozens of contractors to scan X, Facebook, TikTok, and other platforms to target people for deportation...

Exploit-Notes

Exploit Notes Exploit Notes is sticky notes for pentesting...

WordPress plugin The Ultimate Viral Quiz 跨站请求伪造漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress is a blogging platform developed using the PHP language, which provides the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an applicatio...

Malicious ZIP Files Use Windows Shortcuts to Drop Malware

Cybersecurity firm Blackpoint Cyber reveals a new spear phishing campaign targeting executives. Learn how attackers use fraudulent document ZIPs containing malicious shortcut files, leveraging 'living off the land' tactics, and a unique Anti-Virus check to deliver a custom payload...

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

🛡️ pwnkit-helper - Elevate Your Hacking Skills Safely !Down...

PT-2025-40126

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc5 mlnx Description A flaw exists in the net/mlx5 component of the Linux kernel related to delayed bond work cancellation. A missing call to cancel delayed work could lead to the execution of code on an...

Improper Authentication

esphome is vulnerable to improper authentication. The vulnerability is due to the webserver authentication check incorrectly passing when the client-supplied base64-encoded Authorization value is empty or a substring of the correct value, which allows an attacker to gain unauthorized access to...

CVE-2025-8214

CVE-2025-8214 concerns The Pack Elementor addon for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) in the widget “Typing Letter”, affecting all versions up to and including 2.1.5. Root cause is insufficient input sanitization and output escaping on user-supplied attributes, e...

CVE-2025-8214 The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-8214 The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget

The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

NewStart CGSL MAIN 6.06 : system-config-printer Vulnerability (NS-SA-2025-0233)

The remote NewStart CGSL host, running version MAIN 6.06, has system-config-printer packages installed that are affected by a vulnerability: - The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an insecure...

CVE-2025-60141

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS.This issue affects The Tribal: from n/a through = 1.3.3...

CVE-2025-60140

Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through = 1.3.3...

CVE-2025-59932 FlagForgeCTF Unauthenticated Resource Modification/Deletion

Flag Forge is a Capture The Flag CTF platform. From versions 2.0.0 to before 2.3.1, the /api/resources endpoint previously allowed POST and DELETE requests without proper authentication or authorization. This could have enabled unauthorized users to create, modify, or delete resources on the...

SUSE CVE-2025-59347

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat job...

OESA-2025-2357 python-httpie security update

HTTPie pronounced aitch-tee-tee-pie is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs HTTP servers. The http https commands allow for creating and sendi...

OESA-2025-2358 python-httpie security update

HTTPie pronounced aitch-tee-tee-pie is a command-line HTTP client. Its goal is to make CLI interaction with web services as human-friendly as possible. HTTPie is designed for testing, debugging, and generally interacting with APIs HTTP servers. The http https commands allow for creating and sendi...