Critical Cryptographic Weakness in WPS Office Enables Update Hijacking (CVE-2025-2516)
CVE-2025-2516 exposes WPS Office to critical update hijacking due to weak cryptographic keys and lack of server certificate…
Karl.Fail
Vulnerabilities
Vulnerability notes, technical breakdowns, and security research.
Critical Authentication Bypass in U-Office Force (CVE-2025-2395)
CVE-2025-2395 allows attackers to bypass authentication in U-Office Force by manipulating cookies and using a vulnerable API. Upgrade to v28.0…
Critical Authentication Bypass in BuddyBoss Platform Pro (CVE-2025-1909)
CVE-2025-1909 is a critical flaw in BuddyBoss Platform Pro that allows attackers to bypass authentication via Apple OAuth and access any user…
Critical RCE Vulnerability in Kubernetes ingress-nginx (CVE-2025-1974)
CVE-2025-1974 is a critical RCE vulnerability in Kubernetes ingress-nginx allowing unauthenticated attackers to access Secrets and execute arbitrary…
CVE-2025-29814: Critical Privilege Escalation in Microsoft Partner Center
CVE-2025-29814 is a critical privilege escalation vulnerability in Microsoft Partner Center, scored 9.3 by CVSS and caused by improper…
CSRF Vulnerability in WordPress User Profile Meta Manager Plugin (CVE-2025-48340)
CVE-2025-48340 exposes a critical CSRF vulnerability in the User Profile Meta Manager plugin, allowing privilege escalation on WordPress…
CVE-2025-47284: Critical Privilege Escalation in Gardener via Metadata Injection
A critical flaw in Gardener’s gardenlet component allows project admins to gain control of seed clusters. CVE-2025-47284 affects GCP environments…
CVE-2025-47283: Critical Privilege Escalation in Gardener Kubernetes Management
CVE-2025-47283 exposes a critical privilege escalation flaw in Gardener’s Kubernetes management due to improper input validation. Immediate patching
CVE-2025-1638: Authentication Bypass in Alloggio Membership Plugin via Social Login
CVE-2025-1638 exposes a critical flaw in Alloggio Membership plugin allowing full login bypass via Facebook and Google social login…
CVE-2025-1315: Critical Privilege Escalation via Password Reset in InWave Jobs WordPress Plugin
CVE-2025-1315 is a critical flaw in InWave Jobs plugin that allows unauthenticated attackers to reset user passwords and gain admin…
CVE-2025-1307: Critical Arbitrary File Upload in Newscrunch WordPress Theme
CVE-2025-1307 is a critical flaw in the Newscrunch WordPress theme allowing authenticated users to upload arbitrary files and execute…
CVE-2025-1061: Critical Authentication Bypass in Nextend Social Login Pro via Apple OAuth
CVE-2025-1061 is a critical authentication bypass in Nextend Social Login Pro via Apple OAuth, allowing admin…