CVE-2025-29922: Unauthorized Object Manipulation via APIExport in kcp Virtual Workspaces
CVE-2025-29922 in kcp allows unauthorized creation and deletion of objects across workspaces via a broken APIExport authorization…
Karl.Fail
Vulnerabilities
Vulnerability notes, technical breakdowns, and security research.
CVE-2025-22224: Critical TOCTOU Vulnerability in VMware ESXi and Workstation
CVE-2025-22224 is a critical TOCTOU flaw in VMware that allows VM-based code execution on the host. Active exploitation…
CVE-2025-22248: Unauthenticated Access via Default Pgpool Configuration in Bitnami PostgreSQL Deployments
CVE-2025-22248 allows unauthenticated access to PostgreSQL via insecure defaults in Bitnami’s pgpool and postgres-ha…
CVE-2025-20125: Cisco Identity Services Engine API Authorization Bypass Vulnerability
CVE-2025-20125 exposes Cisco ISE to critical risks through insufficient API authorization, enabling attackers with read-only access to compromise…
CVE-2025-20156: Critical Privilege Escalation in Cisco Meeting Management REST API
CVE-2025-20156 allows low-privileged users to escalate to admin in Cisco Meeting Management via insecure REST API…
CVE-2025-20188: Critical File Upload and Command Execution Vulnerability in Cisco IOS XE
CVE-2025-20188 allows unauthenticated remote attackers to upload files and run root commands in Cisco IOS XE via hard-coded…
CVE-2025-20124: Critical Java Deserialization Vulnerability in Cisco ISE
CVE-2025-20124 allows authenticated remote attackers to execute root commands on Cisco ISE via Java…
CVE-2025-26763: PHP Object Injection in MetaSlider Plugin for WordPress
CVE-2025-26763 exposes a critical PHP Object Injection vulnerability in MetaSlider ≤ 3.94.0, allowing unauthenticated code…
CVE-2025-26692: Path Traversal Vulnerability in SIOS Quick Agent
CVE-2025-26692 allows remote attackers to execute code via a path traversal issue in SIOS Quick Agent V2 and…
CVE-2025-2780: Critical File Upload Vulnerability in Woffice Core Plugin
CVE-2025-2780 in Woffice Core allows Subscriber+ users to upload arbitrary files, potentially leading to remote code…
CVE-2025-2798: Critical Authentication Bypass in Woffice CRM WordPress Theme
CVE-2025-2798 allows attackers to gain admin access via custom registration forms in Woffice ≤ 5.4.21. Update…
CVE-2025-2332: PHP Object Injection Vulnerability in WordPress Export Plugin
CVE-2025-2332 exposes a critical PHP Object Injection flaw in a popular WordPress export plugin, potentially allowing code…