CVE-2025-31872

No technical details about CVE-2025-31872 are provided in the connected documents. Initial description mentions a Missing Authorization issue affecting WP Clone any post type (up to 3.4), but there are no confirmed product/version/root‑cause data or fixes in the supplied sources. Monitor for upda...

CVE-2025-31870 WordPress WP AutoKeyword plugin <= 1.0 - Arbitrary Content Deletion vulnerability

Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP AutoKeyword: from n/a through 1.0...

CVE-2025-31799 WordPress Publitio plugin <= 2.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Publitio: from n/a through = 2.1.8...

CVE-2025-30797

CVE-2025-30797: Missing Authorization in Greek Multi Tool (WordPress plugin) – affects Greek Multi Tool – Ultimate Greek Language Toolkit up to version 2.3.1. Root cause is Incorrectly Configured Access Control, enabling unauthorized actions via network access with no privileges required; CVSS v3...

PT-2025-15259 · General · Kraken Stress Testing Toolkit

Уязвимость инструмента нагрузочного тестирования SIEM-систем Kraken Stress Testing Toolkit вызвана недостатками процедуры авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ к защищаемой информации...

CVE-2025-24250

This issue was addressed with improved access restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app acting as a HTTPS proxy could get access to sensitive user data...

CVE-2025-31123 Zitadel Expired JWT Keys Usable for Authorization Grants

Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails to properly check the expiration date of the JWT key when used for Authorization Grants. This allows an attacker with an expired key to...

CVE-2025-27095

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged account can access the Kubernetes session feature and manipulate the kubeconfig file to redirect API requests to an external server...

CVE-2025-30209 Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tule...

CVE-2025-31545 WordPress Safe Ai Malware Protection for WP plugin <= 1.0.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Messiah Safe Ai Malware Protection for WP safe-ai-malware-protection-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Safe Ai Malware Protection for WP: from n/a through = 1.0.20...

CVE-2025-31376 WordPress NanoSupport plugin <= 0.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mayeenul Islam NanoSupport nanosupport allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NanoSupport: from n/a through = 0.6.0...

PT-2025-13995 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 18.4 iPadOS versions prior to 18.4 Description: The issue allows a person with physical access to an iOS device to access photos from the lock screen. This was addressed through improved state management. Recommendations...

PT-2025-13627 · Totolink · Totolink A3000Ru

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3000RU versions up to 5.9c.5185 Description: A vulnerability has been found in the IBMS Configuration File Handler component, affecting the /cgi-bin/ExportIbmsConfig.sh file. This issue leads to improper access controls and can be...

CVE-2025-30894

Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through = 1.79.262...

Unauthorized Object Creation And Deletion

kcp is vulnerable to unauthorized object creation and deletion. The vulnerability is due to improper enforcement of access controls in the APIExport VirtualWorkspace, allowing object creation and deletion in arbitrary workspaces without proper authorization checks...

GitLab 17.4 < 17.8.6 / 17.9 < 17.9.3 / 17.10 < 17.10.1 (CVE-2025-2242)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An improper access control vulnerability in GitLab CE/EE affecting all versions from 17.4 prior to 17.8.6, 17.9 prior to 17.9.3, and 17.10 prior to 17.10.1 allows a user who was an instance admin befo...

CVE-2025-22740

CVE-2025-22740 (Sensei LMS) is a Missing Authorization vulnerability affecting Sensei LMS versions up to 4.24.4. Public details indicate an authorization gap that could allow access to restricted actions/resources. The vulnerability is listed as patched by Wordfence (patched status) and the CVSS ...

CVE-2025-30909

CVE-2025-30909 pertains to Conversios.io (Conversios: Google Analytics GA4, Google Ads, GTM & Pixel tracking) where a Missing Authorization flaw exists in versions up to 7.2.3. The connected ENISA vulnerability entry EUVD-2025-8313 confirms this issue as a “Missing Authorization” flaw and notes a...

Origin Validation Error

Prefect is vulnerable to Origin Validation Error. The vulnerability is due to improper access control due to unauthorized domains being allowed to access sensitive data, leading to potential data leaks, loss of confidentiality, service disruption, and data integrity risks...

D-Link DIR-605L/DIR-618 formAdvNetwork Function Access Control Error Vulnerability

The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-605L version 3.02 and the D-Link DIR-618 version 2.02, which stems from improper access control in the file /goform/formAdvNetwork, and can...