WordPress Fancy Product Designer plugin server-side request forgery vulnerability

WordPress Fancy Product Designer plugin is an e-commerce plugin designed for the WordPress platform, mainly used to implement the product online customization function. A server-side request forgery vulnerability exists in the WordPress Fancy Product Designer plugin, which stems from the presence...

Real Time Logic FuguHub 安全漏洞

Real Time Logic FuguHub is a consumer product from Real Time Logic developed using the Barracuda Application Server SDK. A security vulnerability exists in Real Time Logic FuguHub version 8.1 that stems from the /fs/ file manager interface not cleaning up or restricting script execution when...

CVE-2025-65857

The CVE-2025-65857 affects Xiongmai XM530 IP cameras (firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06). The GetStreamUri ONVIF endpoint exposes RTSP URIs containing hardcoded credentials, enabling direct unauthorized video streaming access. Impact is unauthorized access to live streams; CV...

RHEL 7 : kernel-rt (RHSA-2025:23960)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:23960 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...

PT-2025-52712

Name of the Vulnerable Software and Affected Versions Atom CMS version 2.0 Description Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the id...

EUVD-2025-204643

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating...

CVE-2025-34290

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating...

CVE-2025-34290 Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating...

CVE-2025-34290 Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating...

WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin WP Time Slots Booking Form versions = 1.2.39...

CVE-2025-67586

creationtimestamp| type| source ---|---|--- 2025-12-20 09:00:05+00:00| published-proof-of-concept| Telegram/IsgSMFcAG-ApRHDdzepdVGoV7GGJJ0rJ6FS3vxu8huYyqZo 2026-04-22 13:01:06+00:00| seen| https://bsky.app/profile/exploitdb-bot.bsky.social/post/3mk3kjypomc27 2026-04-23 21:03:14+00:00| seen|...

CVE-2025-68475

creationtimestamp| type| source ---|---|--- 2025-12-20 04:59:06+00:00| published-proof-of-concept| https://github.com/fedify-dev/fedify/security/advisories/GHSA-rchf-xwx2-hm93 2025-12-20 05:16:54+00:00| seen| https://bsky.app/profile/fedify.hollo.social.ap.brid.gy/post/3mafhaodfztz2 2025-12-20...

CVE-2025-34433

creationtimestamp| type| source ---|---|--- 2025-12-19 17:01:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mae65ijor42o 2025-12-20 05:35:12+00:00| seen| https://infosec.exchange/users/offseq/statuses/115750267184627637 2025-12-20 05:35:13+00:00| seen|...

SUSE-SU-2026:20015-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 16.0 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50253: bpf: make sure skb-len != 0 when redirecting to a tunneling device bsc1249912. - CVE-2025-37916: pdscore: remove write-after-free of clientid bsc1243474. -...

CVE-2025-59488

creationtimestamp| type| source ---|---|--- 2025-12-19 16:30:17+00:00| seen| https://infosec.place/objects/38a16678-ca82-4bb6-9fdd-78575a7a890d...

CVE-2025-40891

A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An unauthenticated attacker can send specially crafted network packets at two different times to inject HTML tags into asset attributes across t...

Exploit for CVE-2025-68055

CVE-2025-68055 Authenticated SQL injection in Hydra Booking...

filelock has TOCTOU race condition that allows symlink attacks during lock file creation

...

CVE-2025-68488

creationtimestamp| type| source ---|---|--- 2025-12-19 07:36:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mad6lhwo6r2e...

CVE-2025-65564

A denial-of-service vulnerability exists in the omec-upf upf-epc-pfcpiface in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the association setup handler dereferences a nil pointer...