CVE-2025-46739

An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...

CVE-2025-46739 Improper Restriction of Excessive Authentication Attempts

An unauthenticated user could discover account credentials via a brute-force attack without rate limiting...

Intel® Core™ Ultra Processor Firmware Advisory

Summary: Potential security vulnerabilities for some Intel® Core™ Ultra processors may allow information disclosure. Intel is releasing microcode updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2025-24495 Description: Incorrect initialization of resource in...

WordPress Cool Author Box plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nabil Irawan in WordPress Plugin Cool Author Box versions = 3.0.0...

PT-2025-19796 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions 3.5.0.beta4 before commit 82d84af6b0efbd9fa2aeec3e91ce7be1a768511b Description: A data leak issue affects Discourse, an open-source community platform, allowing some content on the site's homepage to be visible to...

CVE-2025-46349 YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

CVE-2025-46349

YesWiki (PHP-based wiki) prior to 4.5.4 is vulnerable to a reflected XSS in the file-upload form. The issue allows unauthenticated attackers to craft a link that, when clicked by a victim, can execute arbitrary scripts in the victim’s browser. The vulnerability is patched in version 4.5.4; remedi...

CVE-2025-24271

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, tvOS 18.4, macOS Ventura 13.7.5, iPadOS 17.7.6, macOS Sonoma 14.7.5, iOS 18.4 and iPadOS 18.4, visionOS 2.4. An unauthenticated user on the same network as a signed-in Mac could send it...

CVE-2025-32044

CVE-2025-32044 affects Moodle via unauthenticated access to sensitive user data exposed through stack traces returned by specific REST API calls. Affected until PHP is configured with zend.exception_ignore_args != 1 (sites with zend.exception_ignore_args = 1 are not affected). The CVE entry notes...

tRPC 11 WebSocket DoS Vulnerability

Summary An unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to crash a tRPC 11 WebSocket server. Details Any tRPC 11 server with WebSocket enabled with a createContext method set is vulnerable. Here is a...

GHSA-F69V-XRJ8-RHXF org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API

Impact It is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when "Prevent unregistered users from viewing pages, regardless of the page rights" and "Preven...

📄 BentoML 1.4.2 Remote Code Execution

A remote code execution vulnerability caused by insecure deserialization has been identified in version 1.4.2 of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. This module requires Metasploit: https://metasploit.com/download Current source:...

CVE-2025-22371 SQL-injection in admin_login_handler allows unauthenticated user to log in as an administrator in SicommNet BASEC

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in SicommNet BASEC SaaS Service login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 De...

CVE-2025-27441

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access...

CVE-2025-27442

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access...

CVE-2025-27442

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access...

CVE-2025-27442 Zoom Workplace Apps - Cross Site Scripting

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access...

CVE-2025-27442 Zoom Workplace Apps - Cross Site Scripting

Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access...

CVE-2025-27442

CVE-2025-27442 corresponds to a cross-site scripting vulnerability in Zoom Workplace Apps. The issue allows an unauthenticated attacker to potentially compromise integrity via adjacent network access, with user interaction required. The exploits/patch status is not detailed in the provided docume...

CVE-2025-27441

CVE-2025-27441 is a cross-site scripting issue in Zoom Workplace Apps caused by improper filtering of user-supplied input. The vulnerability could allow an unauthenticated attacker to compromise data integrity via adjacent network access. The connected sources corroborate the vulnerability and it...