The vulnerability of the Ansible configuration management system arises from improper processing of output data for registration logs, allowing an attacker to gain unauthorized access to protected information.

The vulnerability of the Ansible configuration management system is related to incorrect processing of output data for registration logs. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via improper validation of $tokenAudience. A user can gain unauthorized access to protected resources by submitting an ID token in place of an access token. Remediation Upgrade auth0/auth0-php to version 8.18.0 o...

CVE-2025-68111

ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the eGive.php file within the "ReImport" functionality. An authenticated user with finance privileges can execute arbitrary SQL queries by manipulating the MissingEgiveFamID...

CVE-2025-34437 AVideo < 20.1 IDOR Arbitrary Comment Image Upload

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects...

EUVD-2025-203901

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information...

CVE-2025-26381

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information...

CVE-2025-26381

CVE-2025-26381 affects Johnson Controls OpenBlue Mobile Web Application for OpenBlue Workplace (versions 2025.1.2 and earlier). The vulnerability is described as a Direct Request (forced browsing) issue that could allow an attacker to access sensitive information without authentication. Publicly ...

CVE-2025-26381 OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information...

CVE-2025-26381 OpenBlue Mobile Web Application configuration issue for optional for OpenBlue Workplace (formerly FM Systems)

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information...

CVE-2025-62329

HCL DevOps Deploy / HCL Launch is susceptible to a race condition in http-session client-IP binding enforcement which may allow a session to be briefly reused from a new IP address before it is invalidated. This could lead to unauthorized access under certain network conditions...

CVE-2025-14095

A "Privilege boundary violation" vulnerability is identified affecting multiple Radiometer Products. Exploitation of this vulnerability gives a user with physical access to the analyzer, the possibility to gain unauthorized access to functionalities outside the restricted environment. The...

CVE-2025-14095

CVE-2025-14095, CVE-2025-14096, and CVE-2025-14097 describe vulnerabilities in multiple Radiometer products. The issues arise from design weaknesses in application/OS access control, credential protection, and remote code execution conditions, with exploitation involving physical access (for 1409...

CVE-2025-67948

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from n/a through = 2.2.1...

CVE-2025-12809

The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /dokan/v1/wholesale/register REST API endpoint in all versions up to, and including, 4.1.3. This makes it possible for unauthenticated attackers to enumerate users and retrieve...

CVE-2025-13956

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

CVE-2025-13880

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...

EUVD-2025-203870

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...

CVE-2025-13880 WP Social Ninja - Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 4.0.1 - Missing Authorization to Unauthenticated Plugin's Settings Disclosure And Modification

The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets Google Reviews, YouTube Feed, Photo Feeds, and More plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the getAdvanceSettings and saveAdvanceSettings...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Google Android

An improved poc of...

CVE-2025-11369

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the getinstagramaccesstokencallback, googlemapapikeysavecallback and getsiteinfo functions in all...