Aggregator

Crime Gang Begins Leaking Stolen Freedman HealthCare Data
Cybercriminal gang World Leaks - formerly Hunters International - reportedly claims to have stolen 52.4 gigabytes of data containing 42,204 files from Massachusetts-based Freedman HealthCare, a contractor that provides data integration and analytics services to state health agencies.

Iranian Officials Call Internet Outages Intentional to Disrupt Israeli Operations
Iranian officials said widespread internet outages were deliberate and meant to disrupt covert Israeli operations within the country following days of missile attacks from Israel and a rapidly escalating regional conflict that experts warn could trigger major cyberattacks on critical infrastructure.

Deal Expands Native Email Security and Response Workflows for MDR and MSP Clients
Bitdefender’s acquisition of Irish startup Mesh adds native email protection to its XDR and MDR portfolios. Mesh’s dual-mode defense and MSP-friendly design provide deeper visibility, faster remediation and enhanced threat response across hybrid environments.

A vulnerability, which was classified as problematic, was found in pam-config. Affected is an unknown function. The manipulation leads to configuration. This vulnerability is traded as CVE-2025-6018. Attacking locally is a requirement. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Gutenverse News Plugin up to 1.0.4 on WordPress. This issue affects some unknown processing. The manipulation of the argument elementId leads to cross site scripting. The identification of this vulnerability is CVE-2025-5234. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as problematic was found in Classic Addons WPBakery Page Builder Plugin up to 8.4.1 on WordPress. This vulnerability affects unknown code of the component Grid Builder. The manipulation leads to cross site scripting. This vulnerability was named CVE-2025-4965. The attack can be initiated remotely. There is no exploit available.

A vulnerability classified as problematic has been found in Football Pool Plugin up to 2.12.4 on WordPress. This affects an unknown part. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2025-5490. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in ElementsKit Elementor Addons and Templates Plugin up to 3.5.2 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Image Comparison Widget. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2025-4479. The attack may be launched remotely. There is no exploit available.

A vulnerability was found in Download Manager Plugin up to 3.3.18 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function wpdm_user_dashboard of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2025-4367. The attack can be launched remotely. There is no exploit available.

A vulnerability was found in AI Engine Plugin up to 2.8.3 on WordPress. It has been classified as critical. Affected is the function Meow_MWAI_Labs_MCP::can_access_mcp of the component MCP. The manipulation leads to privilege escalation. This vulnerability is traded as CVE-2025-5071. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in GiveWP Plugin up to 4.3.0 on WordPress and classified as critical. This issue affects the function permissionsCheck. The manipulation leads to missing authorization. The identification of this vulnerability is CVE-2025-4571. The attack may be initiated remotely. There is no exploit available.

A vulnerability has been found in OceanWP Plugin up to 4.0.9 on WordPress and classified as problematic. This vulnerability affects unknown code of the component HTML Tag Handler. The manipulation of the argument Select leads to HTML injection. This vulnerability was named CVE-2025-5524. The attack can be initiated remotely. There is no exploit available.

A vulnerability, which was classified as critical, was found in Widget Logic Plugin up to 6.0.5 on WordPress. This affects an unknown part. The manipulation leads to privilege escalation. This vulnerability is uniquely identified as CVE-2025-32222. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability, which was classified as critical, has been found in Themify Edmin Theme Plugin up to 2.0.0 on WordPress. Affected by this issue is some unknown functionality. The manipulation leads to deserialization. This vulnerability is handled as CVE-2025-31047. The attack may be launched remotely. There is no exploit available.

A vulnerability classified as critical was found in Photography Plugin up to 7.5.2 on WordPress. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. This vulnerability is known as CVE-2025-47579. The attack can be launched remotely. There is no exploit available.

The pro-Israel "Predatory Sparrow" hacking group claims to have stolen over $90 million in cryptocurrency from Nobitex, Iran's largest crypto exchange, and burned the funds in a politically motivated cyberattack. [...]

A vulnerability classified as critical has been found in pbootCMS 3.2.5/3.2.10. Affected is an unknown function of the component GET Request Handler. The manipulation leads to sql injection. This vulnerability is traded as CVE-2025-46109. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability was found in Open5GS up to 2.7.2. It has been rated as critical. This issue affects the function ogs_pfcp_subnet_add of the component PFCP Library. The manipulation of the argument session.dnn leads to buffer overflow. The identification of this vulnerability is CVE-2025-44952. The attack needs to be approached locally. There is no exploit available.

A vulnerability was found in Open5GS up to 2.7.2. It has been declared as critical. This vulnerability affects the function ogs_pfcp_dev_add. The manipulation of the argument session.dev leads to buffer overflow. This vulnerability was named CVE-2025-44951. It is possible to launch the attack on the local host. There is no exploit available.

A vulnerability was found in Profisee on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2025-6240. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.