Aggregator

Researchers say Israel remains a central focus, with UNC1549 targeting aerospace and defense entities in the US, the UAE, Qatar, Spain, and Saudi Arabia.

Officials at the Congressional Budget Office “have not observed further evidence of unauthorized access" to the legislative branch agency's systems, Director Phillip Swagel told lawmakers.

A vulnerability was found in HPE Aruba Networking 100 Cellular Bridge up to 10.7.1.1 and classified as critical. This vulnerability affects unknown code of the component Command Line Interface. Executing manipulation can lead to command injection. This vulnerability is handled as CVE-2025-37162. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in HPE Aruba Networking 100 Cellular Bridge up to 10.7.1.1 and classified as problematic. This affects an unknown part of the component Web-based Management Interface. Performing manipulation results in denial of service. This vulnerability is known as CVE-2025-37161. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in SureForms Plugin up to 1.13.1 on WordPress. Affected by this issue is the function wp_rest of the component REST API Endpoint. Such manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2025-12535. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in Pet-Manager Plugin up to 3.6.1 on WordPress. Affected by this vulnerability is the function kwm-petfinder of the component Shortcode Handler. This manipulation causes cross site scripting. This vulnerability appears as CVE-2025-12710. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as critical was found in Responsive Lightbox & Gallery Plugin up to 2.5.3 on WordPress. Affected is the function get_image_size_by_url. The manipulation results in server-side request forgery. This vulnerability is reported as CVE-2025-12359. The attack can be launched remotely. No exploit exists.

A vulnerability classified as problematic has been found in User Profile Builder Plugin up to 3.14.8 on WordPress. This impacts an unknown function of the component Shortcode Handler. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2025-13054. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as problematic has been identified in Quiz Maker Plugin up to 6.7.0.80 on WordPress. This affects the function ays_quiz_check_answer. Executing manipulation can lead to information disclosure. This vulnerability is registered as CVE-2025-12426. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as problematic has been reported in Royal Elementor Addons and Templates Plugin up to 1.7.1036 on WordPress. The impacted element is an unknown function. Performing manipulation of the argument item['field_id'] results in cross site scripting. This vulnerability is cataloged as CVE-2025-6251. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as problematic has been found in FunnelKit Plugin up to 3.13.1.2 on WordPress. The affected element is the function wfop_phone of the component Shortcode Handler. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE-2025-12878. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as problematic has been detected in SiteSEO Plugin up to 1.3.2 on WordPress. Impacted is the function resolve_variables of the component AJAX Handler. This manipulation causes improper control of resource identifiers. This vulnerability is tracked as CVE-2025-13085. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as critical has been discovered in Community Events Plugin up to 1.5.4 on WordPress. This issue affects some unknown processing. The manipulation of the argument dayofyear results in sql injection. This vulnerability is identified as CVE-2025-12646. The attack can be executed remotely. There is not any exploit available.

A vulnerability was found in SiteSEO Plugin up to 1.3.2 on WordPress. It has been rated as critical. This vulnerability affects the function siteseo_reset_settings of the component Setting Handler. The manipulation leads to improper authorization. This vulnerability is referenced as CVE-2025-12814. Remote exploitation of the attack is possible. No exploit is available.