Why we’re no longer doing April Fools’ Day

The internet is filled with falsehoods. We’re forever investigating new scams here at Malwarebytes, and so we get how hard it is to know what—or who—to trust online. There’s the scam that takes advantage of grieving people and tricks them into paying for a funeral live stream. There’s the fake...

CVE-2025-30883

Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through = 2.3...

tough root metadata version is not checked for sequential versioning

Summary When updating the root role, a TUF client must establish a trusted line of continuity to the latest set of keys. While sequentially downloading new versions of the root metadata file, tough will not check that the root object version it received was the next sequential version from the...

CVE-2025-28942

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a throug...

US Department of Labor’s journey to Zero Trust security with Microsoft Entra ID

For several years, Microsoft has been helping United States federal and state government groups, including military departments and civilian agencies, transition to a Zero Trust security model. Advanced features in Microsoft Entra ID have helped these organizations meet requirements to employ...

CVE-2025-30883

Missing Authorization vulnerability in richplugins Trust.Reviews fb-reviews-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trust.Reviews: from n/a through = 2.3...

CVE-2025-30883

CVE-2025-30883 is a Missing Authorization issue in the Trust.Reviews fb-reviews-widget (Social Reviews & Recommendations). The Wordfence entry confirms a Missing Authorization weakness affecting Trust.Reviews before patching, with CVSS v3.1 base score ~4.3. Impact centers on improper access contr...

Fortinet FortiNAC-F Trust Management Issues Vulnerability

Fortinet FortiNAC-F is a set of network access control solutions from the American Fiat Fortinet. The product is mainly used for network access control and IoT security. Fortinet FortiNAC-F suffers from a trust management issue vulnerability that stems from improper certificate validation, which...

CVE-2025-28942

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a throug...

CVE-2025-28942 WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a throug...

CVE-2025-28942

CVE-2025-28942 describes an SQL injection in the WordPress plugin “Trust Payments Gateway for WooCommerce” affecting versions up to 1.1.4. The vulnerability is categorized as a severe SQL injection with CVSS v3.1 base score 9.3 (CRITICAL); attack vector: NETWORK, complexity: LOW, privileges requi...

CVE-2025-28942 WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Trust Payments Trust Payments Gateway for WooCommerce trust-payments-hosted-payment-pages-integration allows SQL Injection.This issue affects Trust Payments Gateway for WooCommerce: from n/a throug...

WordPress plugin Trust Payments Gateway for WooCommerce SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the...

(0Day) CarlinKit CPC200-CCPA Missing Root of Trust Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of CarlinKit CPC200-CCPA devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

GHSA-5PQ3-H73F-66HR AWS CDK CodePipeline: trusted entities are too broad

Summary The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre-built components...

AWS CDK CodePipeline: trusted entities are too broad

Summary The AWS Cloud Development Kit CDK is an open-source framework for defining cloud infrastructure using code. Users use it to create their own applications, which are converted to AWS CloudFormation templates during deployment to a user's AWS account. AWS CDK contains pre-built components...

actix-telepathy (>=0.5.4, <=0.6.1), agnostic (>=0.1.18, <=0.2.0) +59 more potentially affected by unknown CVE via trust-dns-proto (0.23.2)

trust-dns-proto CARGO version 0.23.2 is affected by a known vulnerability. The following packages have a transitive dependency on trust-dns-proto and may be impacted: - actix-telepathy =0.5.4, =0.1.18, =0.23.0-alpha.2, =0.1.0, =0.5.0, =0.5.0, =0.5.0, =0.2.0, =0.4.2 and more Source cves: unknown C...

RUSTSEC-2025-0017 The `trust-dns` project has been rebranded to `hickory-dns`

The trust-dns-proto crate is now available as hickory-proto...

CVE-2024-12869 Improper Authentication in infiniflow/ragflow

In infiniflow/ragflow version v0.12.0, there is an improper authentication vulnerability that allows a user to view another user's invite list. This can lead to a privacy breach where users' personal or private information, such as email addresses or usernames in the invite list, could be exposed...

WordPress Trust Payments Gateway for WooCommerce plugin <= 1.1.4 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Aiden Thái An in WordPress Plugin Trust Payments Gateway for WooCommerce versions = 1.1.4...