🚨 CVE-2025-47337
Memory corruption while accessing a synchronization object during concurrent operations.
🎖@cveNotify
Memory corruption while accessing a synchronization object during concurrent operations.
🎖@cveNotify
🚨 CVE-2025-47343
Memory corruption while processing a video session to set video parameters.
🎖@cveNotify
Memory corruption while processing a video session to set video parameters.
🎖@cveNotify
🚨 CVE-2025-47346
Memory corruption while processing a secure logging command in the trusted application.
🎖@cveNotify
Memory corruption while processing a secure logging command in the trusted application.
🎖@cveNotify
🚨 CVE-2025-47356
Memory Corruption when multiple threads concurrently access and modify shared resources.
🎖@cveNotify
Memory Corruption when multiple threads concurrently access and modify shared resources.
🎖@cveNotify
🚨 CVE-2025-47369
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
🎖@cveNotify
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
🎖@cveNotify
🚨 CVE-2025-47388
Memory corruption while passing pages to DSP with an unaligned starting address.
🎖@cveNotify
Memory corruption while passing pages to DSP with an unaligned starting address.
🎖@cveNotify
🚨 CVE-2025-47394
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
🎖@cveNotify
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
🎖@cveNotify
🚨 CVE-2025-47395
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
🎖@cveNotify
Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.
🎖@cveNotify
🚨 CVE-2025-47396
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
🎖@cveNotify
Memory corruption occurs when a secure application is launched on a device with insufficient memory.
🎖@cveNotify
🚨 CVE-2025-68637
The Uniffle HTTP client is configured to trust all SSL certificates and
disables hostname verification by default. This insecure configuration
exposes all REST API communication between the Uniffle CLI/client and the
Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.
This issue affects all versions from before 0.10.0.
Users are recommended to upgrade to version 0.10.0, which fixes the issue.
🎖@cveNotify
The Uniffle HTTP client is configured to trust all SSL certificates and
disables hostname verification by default. This insecure configuration
exposes all REST API communication between the Uniffle CLI/client and the
Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks.
This issue affects all versions from before 0.10.0.
Users are recommended to upgrade to version 0.10.0, which fixes the issue.
🎖@cveNotify
🚨 CVE-2025-69080
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.
🎖@cveNotify
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local File Inclusion.This issue affects Gecko: from n/a through <= 1.9.8.
🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Gecko Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2025-69081
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.
🎖@cveNotify
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through <= 3.0.0.
🎖@cveNotify
Patchstack
Local File Inclusion in WordPress Hope Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2025-69082
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.
🎖@cveNotify
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through <= 6.0.3.
🎖@cveNotify
Patchstack
Cross Site Scripting (XSS) in WordPress Arlo Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2025-69333
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
🎖@cveNotify
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through <= 3.8.1.1.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress JetEngine Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2025-69344
Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.
🎖@cveNotify
Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Oneline Lite: from n/a through <= 6.6.
🎖@cveNotify
Patchstack
Broken Access Control in WordPress Oneline Lite Theme
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.
🚨 CVE-2025-9611
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
🎖@cveNotify
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.
🎖@cveNotify
GitHub
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
### Summary
Any malicious website or malvertizement can actuate any and all MCP server tool endpoints via a browser-based DNS rebinding attack.
TL;DR: This attack leverages the browser as a c...
Any malicious website or malvertizement can actuate any and all MCP server tool endpoints via a browser-based DNS rebinding attack.
TL;DR: This attack leverages the browser as a c...
🚨 CVE-2025-32303
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
🎖@cveNotify
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue affects WPCHURCH: from n/a through 2.7.0.
🎖@cveNotify
Patchstack
SQL Injection in WordPress WPCHURCH Plugin
Patchstack is the leading open source vulnerability research organization. Find information and protection for all WordPress and Drupal security issues.