Server-Side Request Forgery (SSRF) in PowerPress Podcasting plugin for WordPress allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources. This can lead to limited information disclosure and potential internal network scanning. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
Server-Side Request Forgery (SSRF) in WPThumb plugin for WordPress up to version 0.10 allows authenticated attackers with low privileges to make the server send crafted requests to internal or external resources, potentially leading to limited information disclosure or low-impact manipulation. No public exploit or active exploitation has been identified, and EPSS score is low (0.04%).
The Postbox's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. The original company behind Postbox is no longer operational, the software will no longer receive updates. The acquiring company (em Client) did not cooperate in vulnerability disclosure.
The Phoenix Code's configuration on macOS, specifically the presence of entitlements: "com.apple.security.cs.allow-dyld-environment-variables" and "com.apple.security.cs.disable-library-validation" allows for Dynamic Library (Dylib) injection. A local attacker with unprivileged access can use environment variables like DYLD_INSERT_LIBRARIES to successfully inject code in application's context and bypass Transparency, Consent, and Control (TCC). Acquired resource access is limited to previously granted permissions by the user. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission. This issue was fixed in commit 0c75fb57f89d0b7d9b180026bc2624b7dcf807da
In the Linux kernel, the following vulnerability has been resolved: net_sched: prio: fix a race in prio_tune() Gerrard Tai reported a race condition in PRIO, whenever SFQ perturb timer fires at the wrong time. The race is as follows: CPU 0 CPU 1 [1]: lock root [2]: qdisc_tree_flush_backlog() [3]: unlock root | | [5]: lock root | [6]: rehash | [7]: qdisc_tree_reduce_backlog() | [4]: qdisc_put() This can be abused to underflow a parent's qlen. Calling qdisc_purge_queue() instead of qdisc_tree_flush_backlog() should fix the race, because all packets will be purged from the qdisc before releasing the lock.
CVE-2025-49978 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in Zara 4 Image Compression WordPress plugin up to version 1.2.17.2 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially causing limited denial of service. No public exploit or active exploitation has been identified, and the EPSS score is low (0.07%).
Information disclosure in ProfileGrid WordPress plugin versions up to 5.9.5.2 allows authenticated attackers with low privileges to retrieve sensitive system information, such as full server paths. This exposure can aid in further attacks by revealing the underlying directory structure. No public exploit or active exploitation has been identified, and the EPSS score is low (0.06%).
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from playbooks handler for guest users which allows an attacker access to the playbook run.
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions in playbook runs, allowing authenticated users without the 'Manage Channel Members' permission to add or remove users from public and private channels by manipulating playbook run participants when the run is linked to a channel.
A security vulnerability in Missing Authorization vulnerability in aguilatechnologies WP Customer Area (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WANotifier WordPress plugin up to version 2.7.7 allows authenticated attackers with low privileges to exploit incorrectly configured access controls, leading to unauthorized modification of settings or data. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%).
A security vulnerability in a Project Management (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, and Disable Image Sizes WordPress plugins allows authenticated attackers with low privileges to exploit incorrectly configured access controls, potentially modifying image size settings. The vulnerability affects all versions up to 1.0.9 and has a low EPSS score (0.05%), with no public exploit or active exploitation confirmed.
A security vulnerability in Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in Missing Authorization vulnerability in mahabub81 User Roles and Capabilities (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Missing authorization in WP User Profile Avatar plugin for WordPress allows authenticated low-privilege users to access or modify profile avatar data without proper permission checks. Affects versions up to 1.0.6. No public exploit or active exploitation identified.
A security vulnerability in Missing Authorization vulnerability in slui Media Hygiene (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-49971 is a security vulnerability (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-Site Request Forgery (CSRF) in BoldGrid Post and Page Builder for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying settings or content, without their consent. The vulnerability affects versions up to 1.27.8 and requires user interaction via a crafted link. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-site request forgery in WP Inventory Manager allows remote attackers to perform unauthorized actions on behalf of a logged-in administrator by tricking them into clicking a crafted link. The vulnerability has a low EPSS score and no evidence of active exploitation, limiting real-world risk despite the network-accessible attack vector.
Cross-Site Request Forgery (CSRF) in JobWP WordPress plugin up to version 2.4.0 allows an attacker to trick an authenticated admin into performing unintended actions, such as modifying plugin settings or creating unauthorized job listings. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the TM Replace Howdy WordPress plugin up to version 1.4.2 allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings, by crafting a malicious link. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the XML Travel Portal Widget plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as modifying plugin settings. The vulnerability affects all versions up to and including 2.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery (CSRF) in Live Sports Streamthunder WordPress plugin up to version 2.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing plugin settings or initiating unauthorized operations. The vulnerability has a low EPSS score (0.02%) and no public exploit or active exploitation has been identified.
Cross-Site Request Forgery (CSRF) in the Oganro Travel Portal Search Widget for HotelBeds APITUDE API plugin for WordPress allows an attacker to trick an authenticated administrator into performing unintended actions, such as changing plugin settings or making unauthorized API requests. The vulnerability affects all versions up to and including 1.0. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
Cross-Site Request Forgery in PixelBeds Channel Manager and Hotel Booking Engine plugin for WordPress allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or making unauthorized bookings. The vulnerability affects all versions up to and including 1.0, with no public exploit or active exploitation identified at this time.
Cross-Site Request Forgery (CSRF) in ClipLink WordPress plugin up to version 1.1 allows an attacker to trick an authenticated admin into performing unintended actions, such as changing settings or deleting data, by luring them to a malicious page. No public exploit or active exploitation has been identified, and the EPSS score is low (0.02%).
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.