CVE-2025-39365

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0...

CVE-2025-23979

creationtimestamp| type| source ---|---|--- 2025-05-19 16:39:08+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16877 2025-05-19 17:13:03+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpk2zau5xf2j...

CVE-2024-12225

creationtimestamp| type| source ---|---|--- 2025-05-06 20:21:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15216 2025-05-06 22:26:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lojwinmu3w22 2025-05-07 00:31:32+00:00| seen| https://t.me/cvedetector/24656...

CVE-2025-46820

phpgt/Dom (versions before 4.1.8) exposes the GITHUB_TOKEN in the Dom workflow run artifact. The ci.yml workflow uploads the build artifact as a zip of the current directory, including the generated .git/config with the run’s token. An attacker can download the artifact during the workflow window...

CVE-2025-3958

A vulnerability was found in withstars Books-Management-System 1.0. It has been classified as problematic. Affected is an unknown function of the file /bookeditdo.html of the component Book Edit Page. The manipulation of the argument Name leads to cross site scripting. It is possible to launch th...

CVE-2025-39383 WordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through = 1.0.9...

CVE-2025-42603

creationtimestamp| type| source ---|---|--- 2025-04-23 11:20:48+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13023 2025-04-23 13:15:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lnibm4dd6z2u 2025-04-23 14:28:51+00:00| seen| https://t.me/cvedetector/23582...

PT-2025-17639

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.1-44 Description The issue is related to the mishandling of packet size in multispectral MIFF image processing, which is connected to the rendering of all channels in an arbitrary order. Recommendations For...

CVE-2025-3326

A vulnerability has been found in iteaj iboot 物联网网关 1.1.3 and classified as problematic. This vulnerability affects unknown code of the file /common/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. The attack can be initiated remotely. The...

CVE-2025-31858 WordPress Local Magic Plugin <= 2.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in matthewrubin Local Magic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Local Magic: from n/a through 2.6.0...

CVE-2025-3039

creationtimestamp| type| source ---|---|--- 2025-03-31 23:31:23+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9788 2025-04-01 00:08:33+00:00| seen| https://bsky.app/profile/potato.software/post/3llplf6usrv26 2025-04-01 03:35:22+00:00| seen| https://t.me/cvedetector/2168...

BELL-CVE-2025-27363

Bulletin has no description...

Cross-Site Request Forgery (CSRF)

org.jenkins-ci.main, jenkins-core is vulnerable to Cross-site request forgery CSRF. The vulnerability is due to improper request validation, which allows unauthorized state changes in Jenkins' UI when a user unknowingly triggers a malicious request...

CVE-2022-49246

In the Linux kernel, the following vulnerability has been resolved: ASoC: atmel: Fix error handling in sndprotoprobe The devicenode pointer is returned by ofparsephandle with refcount incremented. We should use ofnodeput on it when done. This function only calls ofnodeput in the regular path. And...

SAML Signature Validation Bypass

SPID.AspNetCore.Authentication is vulnerable to SAML signature validation bypass. The vulnerability is due to the lack of strict validation of the relationship between the signature and the signed object, allowing an attacker to inject a signed XML element and impersonate any SPID or CIE user...

CVE-2025-1610 LB-LINK AC1900 Router set_blacklist websGetVar os command injection

A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. Affected by this issue is the function websGetVar of the file /goform/setblacklist. The manipulation of the argument mac/enable leads to os command injection. The attack may be launched remotely. The exploit has...

CVE-2024-8224

A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.20. This issue affects the function formSetDebugCfg of the file /goform/setDebugCfg. The manipulation of the argument enable/level/module leads to stack-based buffer overflow. The attack may be initiated remotel...

CVE-2025-21504

...

CVE-2024-55459

CVE-2024-55459 affects keras 3.7.0, allowing an attacker to write arbitrary files to a user’s machine by downloading a crafted tar via the get_file function. The connected IBM advisories corroborate that this vulnerability has been addressed in product-specific updates (e.g., upgrading impacted I...

CVE-2024-11837

creationtimestamp| type| source ---|---|--- 2024-12-13 06:08:50+00:00| seen| https://infosec.exchange/users/cve/statuses/113644020030698635 2024-12-13 08:14:33+00:00| seen| https://t.me/cvedetector/12836...