CVE-2025-53384 – Apache HTTP Server Information Disclosure

CVE ID : CVE-2025-53384

Published : June 28, 2025, 3:15 a.m. | 3 hours, 8 minutes ago

Description : Rejected reason: Not used

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-53385 – Apache HTTP Server Cross-Site Request Forgery

CVE ID : CVE-2025-53385

Published : June 28, 2025, 3:15 a.m. | 3 hours, 8 minutes ago

Description : Rejected reason: Not used

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-6379 – BeeTeam368 Extensions Pro for WordPress Directory Traversal Vulnerability

CVE ID : CVE-2025-6379

Published : June 28, 2025, 4:15 a.m. | 2 hours, 7 minutes ago

Description : The BeeTeam368 Extensions Pro plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_live_fn() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-6350 – WordPress WP VR 360 Panorama Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-6350

Published : June 28, 2025, 4:15 a.m. | 2 hours, 7 minutes ago

Description : The WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hotspot-hover’ parameter in all versions up to, and including, 8.5.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-6381 – BeeTeam368 Extensions plugin for WordPress Directory Traversal Vulnerability

CVE ID : CVE-2025-6381

Published : June 28, 2025, 4:15 a.m. | 2 hours, 7 minutes ago

Description : The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intended directory. This vulnerability can be used to delete the wp-config.php file, which can be leveraged into a site takeover.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-6252 – “Qi Addons For Elementor Stored Cross-Site Scripting Vulnerability”

CVE ID : CVE-2025-6252

Published : June 28, 2025, 5:15 a.m. | 1 hour, 8 minutes ago

Description : The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in all versions up to, and including, 1.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-53097 – Roo Code Schema Fetching File Read and Write Vulnerability

CVE ID : CVE-2025-53097

Published : June 27, 2025, 10:15 p.m. | 4 hours, 59 minutes ago

Description : Roo Code is an AI-powered autonomous coding agent. Prior to version 3.20.3, there was an issue where the Roo Code agent’s `search_files` tool did not respect the setting to disable reads outside of the VS Code workspace. This means that an attacker who was able to inject a prompt into the agent could potentially read a sensitive file and then write the information to a JSON schema. Users have the option to disable schema fetching in VS Code, but the feature is enabled by default. For users with this feature enabled, writing to the schema would trigger a network request without the user having a chance to deny. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent. Version 3.20.3 fixed the issue where `search_files` did not respect the setting to limit it to the workspace. This reduces the scope of the damage if an attacker is able to take control of the agent through prompt injection or another vector.

Severity: 5.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-53098 – Roo Code MCP Configuration Command Injection Vulnerability

CVE ID : CVE-2025-53098

Published : June 27, 2025, 10:15 p.m. | 4 hours, 59 minutes ago

Description : Roo Code is an AI-powered autonomous coding agent. The project-specific MCP configuration for the Roo Code agent is stored in the `.roo/mcp.json` file within the VS Code workspace. Because the MCP configuration format allows for execution of arbitrary commands, prior to version 3.20.3, it would have been possible for an attacker with access to craft a prompt to ask the agent to write a malicious command to the MCP configuration file. If the user had opted-in to auto-approving file writes within the project, this would have led to arbitrary command execution. This issue is of moderate severity, since it requires the attacker to already be able to submit prompts to the agent (for instance through a prompt injection attack), for the user to have MCP enabled (on by default), and for the user to have enabled auto-approved file writes (off by default). Version 3.20.3 fixes the issue by adding an additional layer of opt-in configuration for auto-approving writing to Roo’s configuration files, including all files within the `.roo/` folder.

Severity: 5.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2024-36347 – AMD CPU ROM Microcode Signature Verification Bypass (Validation Bypass)

CVE ID : CVE-2024-36347

Published : June 27, 2025, 11:15 p.m. | 3 hours, 59 minutes ago

Description : Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged context and compromise of SMM execution environment.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2024-39730 – IBM Datacap Navigator Click Hijacking Vulnerability

CVE ID : CVE-2024-39730

Published : June 28, 2025, 1:15 a.m. | 1 hour, 59 minutes ago

Description : IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2024-52900 – IBM Cognos Analytics Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2024-52900

Published : June 28, 2025, 1:15 a.m. | 1 hour, 59 minutes ago

Description : IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Severity: 6.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-36026 – IBM Datacap Insecure Cookie Handling Vulnerability

CVE ID : CVE-2025-36026

Published : June 28, 2025, 1:15 a.m. | 1 hour, 59 minutes ago

Description : IBM Datacap 9.1.7, 9.1.8, and 9.1.9

does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

CVE-2025-36027 – IBM Datacap Clickjacking Vulnerability

CVE ID : CVE-2025-36027

Published : June 28, 2025, 1:15 a.m. | 1 hour, 59 minutes ago

Description : IBM Datacap 9.1.7, 9.1.8, and 9.1.9

could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…