Aggregator

A CVSS score 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Xavier DANEST - Decathlon' was reported to the affected vendor on: 2025-06-03, 83 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by '06fe5fd2bc53027c4a3b7e395af0b850e7b8a044' was reported to the affected vendor on: 2025-06-03, 83 days ago. The vendor is given until 2025-09-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Ho Xuan Ninh (@izx) + Tri Dang (Sea Security)' was reported to the affected vendor on: 2025-06-03, 83 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N severity vulnerability discovered by 'Ho Xuan Ninh (@izx) + Tri Dang (Sea Security)' was reported to the affected vendor on: 2025-06-03, 78 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Fady Othman' was reported to the affected vendor on: 2025-06-03, 83 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Fady Osman' was reported to the affected vendor on: 2025-06-03, 84 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N severity vulnerability discovered by 'Alfredo Oliveira of Trend Research' was reported to the affected vendor on: 2025-06-03, 84 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Fady Osman' was reported to the affected vendor on: 2025-06-03, 84 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A CVSS score 7.8 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H severity vulnerability discovered by 'Fady Osman' was reported to the affected vendor on: 2025-06-03, 84 days ago. The vendor is given until 2025-10-01 to publish a fix or workaround. Once the vendor has created and tested a patch we will coordinate the release of a public advisory.

A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical. Affected by this issue is some unknown functionality of the file /e3api/api/main/ToJsonByControlName. The manipulation of the argument data leads to sql injection. This vulnerability is handled as CVE-2025-5493. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #586972 / VDB-310910

Developers are driven to deliver new features quickly, while security teams prioritize risk mitigation, which often puts the two at odds. 61% of developers said that it’s critical that security doesn’t block or decelerate the development process or become a barrier to business success. Despite this, collaboration between development and security teams is essential to strengthen both software quality and security, especially given the rising number of data breaches and ransomware attacks. For example, the … More →

The post Development vs. security: The friction threatening your code appeared first on Help Net Security.

A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub_456DE8 of the file /msp_info.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. This vulnerability is known as CVE-2025-5492. The attack can be launched remotely. Furthermore, there is an exploit available.

Submit #575244 / VDB-310909

A vulnerability, which was classified as problematic, was found in Popup Maker Plugin up to 1.20.4 on WordPress. Affected is an unknown function. The manipulation of the argument popupID leads to cross site scripting. This vulnerability is traded as CVE-2025-4205. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Music Player for Elementor Plugin up to 2.4.6 on WordPress. This issue affects some unknown processing. The manipulation of the argument album_buy_url leads to cross site scripting. The identification of this vulnerability is CVE-2025-5340. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic was found in Shared Files Plugin up to 1.7.48 on WordPress. This vulnerability affects the function sanitize_file. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-4392. The attack can be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Profile Builder Plugin up to 3.13.8 on WordPress. This affects the function user_meta/compare of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-4671. It is possible to initiate the attack remotely. There is no exploit available.

Google on Monday released out-of-band fixes to address three security issues in its Chrome browser, including one that it said has come under active exploitation in the wild. The high-severity flaw is being tracked as CVE-2025-5419 (CVSS score: 8.8), and has been flagged as an out-of-bounds read and write vulnerability in the V8 JavaScript and WebAssembly engine. "Out-of-bounds read and

A vulnerability was found in D-Link Go-RT-AC750 revA_v101b03. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file hedwig.cgi. The manipulation of the argument service leads to command injection. This vulnerability is known as CVE-2023-48842. The attack needs to be initiated within the local network. There is no exploit available.