Overview A critical security vulnerability, identified as CVE-2025-13068, has been discovered in the Telegram Bot & Channel plugin for WordPress. This flaw is a Stored Cross-Site Scripting (XSS) vulnerability present in versions up to and including 4.1. Due to insufficient input sanitization and output escaping of the Telegram username field, unauthenticated attackers can inject malicious JavaScript code into the WordPress database. This code is then executed in the browsers of users who access affected pages, potentially leading to account compromise, data theft, or other malicious activities. Technical Details The vulnerability stems from the lack of proper sanitization and escaping of…

Overview CVE-2025-12893 is a medium-severity vulnerability affecting MongoDB servers running on Windows and Apple operating systems. This flaw exposes a weakness in TLS certificate validation, potentially allowing unauthorized clients and servers to establish connections. Specifically, the issue involves improper handling of Extended Key Usage (EKU) requirements during TLS handshakes. This can lead to insecure connections being established even when the presented certificate does not meet the documented EKU standards. Technical Details The vulnerability manifests in two key scenarios: Client Authentication: On Windows and Apple systems, MongoDB servers may accept client certificates during a TLS handshake even if the certificate specifies…

Overview CVE-2025-10646 identifies a medium-severity vulnerability in the Search Exclude plugin for WordPress. This flaw allows authenticated attackers with Contributor-level access or higher to modify plugin settings without proper authorization. Specifically, they can add arbitrary posts to the search exclusion list, potentially impacting website search functionality and content visibility. Technical Details The vulnerability resides in the Base::get_rest_permission() method within the Search Exclude plugin. Versions up to and including 2.5.7 lack sufficient capability checks when this method is called. This oversight enables users with Contributor permissions (and higher roles like Author, Editor, and Administrator) to bypass intended security restrictions and alter…

Overview A critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-6389, has been discovered in the Sneeit Framework plugin for WordPress. This vulnerability affects all versions up to, and including, 8.3. Exploitation of this flaw allows unauthenticated attackers to execute arbitrary code on the server hosting the WordPress site. This poses a significant threat to website security and data integrity. Technical Details The vulnerability resides within the sneeit_articles_pagination_callback() function. This function improperly handles user-supplied input, directly passing it to the call_user_func() function. call_user_func() is a PHP function that calls a function specified by a string. By crafting malicious input, an…

Overview CVE-2025-59373 is a local privilege escalation vulnerability affecting the ASUS System Control Interface. This vulnerability arises from improper validation during the restore mechanism. An unprivileged user can exploit this flaw by copying files without proper validation into protected system directories. This can lead to arbitrary files being executed with SYSTEM privileges, potentially giving the attacker complete control over the affected system. Technical Details The vulnerability lies within the ASUS System Control Interface’s restore functionality. The process allows file restoration to specific locations on the system. However, a lack of sufficient input validation and sanitization allows an attacker to craft…

Overview A critical security vulnerability, identified as CVE-2025-9803, has been discovered in lunary-ai/lunary version 1.9.34. This vulnerability allows for potential account takeover due to improper authentication within the Google OAuth integration. The application’s failure to properly validate the ‘aud’ (audience) field in Google-issued access tokens allows attackers to leverage tokens intended for other malicious applications to gain unauthorized access to legitimate user accounts. This issue has been addressed in version 1.9.35. If you are running an affected version, immediate action is required. Technical Details The vulnerability stems from the lack of proper validation of the ‘aud’ (audience) claim within the…

Overview CVE-2025-65951 is a high-severity vulnerability affecting Inside Track / Entropy Derby, a research-grade horse-racing betting engine. This vulnerability allows the betting operator to bypass the intended delay enforced by the VDF (Verifiable Delay Function) timelock encryption system. By exploiting this flaw, the house can decrypt bet tickets immediately instead of performing the computationally expensive VDF evaluation, potentially leading to unfair advantages and manipulation of the betting process. The vulnerability has been addressed in commit 2d38d2f. Technical Details The vulnerability stems from the fact that bettors were able to pre-compute the entire Wesolowski VDF and include the vdfOutputHex value in…

Overview This blog post details a security vulnerability, identified as CVE-2025-65944, affecting the Sentry-Javascript SDK. This vulnerability could lead to the inadvertent leakage of sensitive HTTP headers, including the Cookie header, to a Sentry organization. If exploited, this could allow unauthorized access and privilege escalation. Technical Details CVE-2025-65944 exists in Sentry-Javascript versions 10.11.0 through 10.26.x. When a Node.js application utilizing the Sentry SDK has the sendDefaultPii: true configuration enabled, certain sensitive HTTP headers are unintentionally sent to Sentry. Specifically, the Cookie header, containing authentication tokens and session identifiers, is captured and stored within the associated Sentry organization’s traces. This occurs…

Overview A critical security vulnerability, identified as CVE-2025-64761, has been discovered in OpenBao, an open-source identity-based secrets management system. This vulnerability allows a privileged operator to escalate their own or another user’s permissions to root-equivalent within the system. This issue affects versions prior to 2.4.4. Immediate action is required to mitigate the risk. Technical Details The vulnerability resides within the identity group subsystem of OpenBao. Specifically, it can be exploited under the following conditions: An operator in the root namespace has access to the identity/groups endpoints. The operator does not have policy access. In this scenario, the operator could add…

Overview CVE-2025-65018 is a high-severity heap buffer overflow vulnerability affecting libpng, the reference library for handling PNG (Portable Network Graphics) images. The vulnerability resides within the simplified API function png_image_finish_read and occurs during the processing of 16-bit interlaced PNG images when configured for 8-bit output format. Specifically, attacker-crafted interlaced PNG files can trigger heap writes beyond the allocated buffer bounds, potentially leading to arbitrary code execution or denial-of-service. This vulnerability affects libpng versions 1.6.0 up to, but not including, 1.6.51. The issue has been addressed in libpng version 1.6.51. Technical Details The vulnerability stems from insufficient bounds checking within the…