WordPress Crypto Tool plugin <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion vulnerability

Missing Authentication to Unauthenticated Limited File Deletion vulnerability discovered by Jonas Benjamin Friedli in WordPress Plugin Crypto versions = 2.22...

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 CVSS score: 9.1, allows an attacker to bypass authentication and...

Malicious code in nadia-nasi33-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2271968d160204312c6779dc75a6d900cca7185f9fe4e18b4a613dee70a2d017 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44050

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic...

CVE-2025-64687

...

CVE-2025-64687

Summary : JetBrains YouTrack prior to version 2025.3.104432 is affected by an improper access control issue that can allow modification of MCP tool logic. This vulnerability is described across multiple sources (Red Hat, ENISA EUVD, CIRCL/CVE sightings, CNNVD, and others) and specifically impacts...

Malicious code in dian-tapai77-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95259dafb41e84ec9f9f031746bc1e243f93a43df0bedf39e1d384df7988aca The package dian-tapai77-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

编号撤回

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A security vulnerability exists in versions prior to JetBrains YouTrack 2025.3.104432, which...

PT-2025-46156

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2025.3.104432 Description Improper access control in JetBrains YouTrack allowed modification of MCP tool logic. Recommendations Update to version 2025.3.104432 or later...

Exploit for Path Traversal in Rarlab Winrar

CVE-2025-8088 WinRAR path traversal tool ⚠ This tool is c...

Exploit for Race Condition in Canonical Ubuntu_Linux

🔐 Linux Privilege Escalation Enumeration Tool !Linuxht...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

CVE-2025-64485

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.4.0 through 2.48.1, a malicious CVAT user with at least the User global role may create files in the root of the mounted file share, or overwrite existing files. If no file share is mounted, the...

CVE-2022-50594

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘data’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitati...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

CVE-2025-63716

The SourceCodester Leads Manager Tool v1.0 is vulnerable to Cross-Site Request Forgery CSRF attacks that allow unauthorized state-changing operations. The application lacks CSRF protection mechanisms such as anti-CSRF tokens or same-origin verification for critical endpoints...

CVE-2025-52881 vulnerabilities

Vulnerabilities for packages: xeol, osv-scanner, buildah, kubernetes-csi-driver-nfs, newrelic-infrastructure-agent, kubescape, checksec, sriov-network-device-plugin, mesosphere-vsphere-csi, node-feature-discovery, undock, zarf, envoy-gateway, falco-no-driver, grype, zot, kubescape-operator, trivy...

SUSE-SU-2025:3989-1 Security update for tiff

This update for tiff fixes the following issues: - CVE-2025-8851: Fixed stack-based buffer overflow vulnerability in tools/tiffcrop.c function readSeparateStripsIntoBuffer by implementing additional error handling bsc1248278...

CVE-2025-64343 (conda) Constructor: Excessive permissions during and after installation

conda Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write...

CVE-2025-64163

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15...