EUVD-2025-205597

hemmelig allows SSRF Filter bypass via Secret Request functionality...

[SECURITY] Fedora 42 Update: fluidsynth-2.5.2-1.fc42

FluidSynth is a real-time software synthesizer based on the SoundFont 2 specifications. It is a "software synthesizer". FluidSynth can read MIDI even ts from the MIDI input device and render them to the audio device. It features real-time effect modulation using SoundFont 2.01 modulators, and a...

CVE-2025-69211 Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)

Nest is a framework for building scalable Node.js server-side applications. Versions prior to 11.1.11 have a Fastify URL encoding middleware bypass. A NestJS application is vulnerable if it uses @nestjs/platform-fastify; relies on NestMiddleware via MiddlewareConsumer for security checks...

CVE-2025-15141

A vulnerability was determined in Halo up to 2.21.10. This issue affects some unknown processing of the file /actuator of the component Configuration Handler. Executing a manipulation can lead to information disclosure. The attack may be performed from remote. This attack is characterized by high...

CVE-2025-15178

creationtimestamp| type| source ---|---|--- 2025-12-29 07:46:15+00:00| seen| https://bsky.app/profile/potato.software/post/3mb4ds2iskw2p 2025-12-29 08:19:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mb4foboscc2q...

CVE-2025-15226

creationtimestamp| type| source ---|---|--- 2025-12-29 07:30:49+00:00| seen| https://bsky.app/profile/potato.software/post/3mb4cwhag7t24 2025-12-29 08:00:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mb4elcciov2t 2025-12-29 08:00:41+00:00| seen|...

Security Bulletin: Vulnerability in ACE affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in ACE has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

CVE-2025-15226 Sunnet｜WMPro - Arbitrary File Upload

WMPro developed by Sunnet has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-68952

Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution RCE vulnerability has been identified in Eigent. This vulnerability allows an attacker to execute arbitrary code on the victim's machine or server through a specific interaction 1-click. This issue has been...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite uses "tomcat-embed-core-10.1.46.jar, js-yaml-4.1.0.tgz, keras-2.14.0-py3-none-any.whl, logback-core-1.5.18.jar, werkzeug-3.0.6-py3-none-any.whl" which are vulnerable to "CVE-2025-61795, CVE-2025-64718, CVE-2025-12058, CVE-2025-11226, CVE-2025-66221". This...

EUVD-2025-205547

A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executing manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available ...

Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation

The software supply chain attacks are becoming more and more focused on trusted development and delivery procedures, so the conventional post-build integrity mechanisms cannot be used anymore. The available frameworks like SLSA, SBOM and in toto are majorly used to offer provenance and traceabili...

PT-2025-53685

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A SQL injection issue exists in itsourcecode Student Management System 1.0. Manipulation of the ID argument in the /statistical.php file can lead to SQL injection. The attack can b...

CVE-2025-56333

An issue in Fossorial fosrl/pangolin v.1.6.2 and before allows a remote attacker to escalate privileges via the 2FA component...

EUVD-2025-205525

Malicious code in cryptozip PyPI...

CVE-2025-15150 PX4 PX4-Autopilot mavlink_log_handler.cpp log_entry_from_id stack-based overflow

A vulnerability was found in PX4 PX4-Autopilot up to 1.16.0. Affected by this issue is the function MavlinkLogHandler::statelisting/MavlinkLogHandler::logentryfromid of the file src/modules/mavlink/mavlinkloghandler.cpp. The manipulation results in stack-based buffer overflow. The attack is only...

CVE-2025-15146

creationtimestamp| type| source ---|---|--- 2025-12-28 17:45:03+00:00| seen| https://bsky.app/profile/potato.software/post/3mb2urmxinu2p 2025-12-28 20:27:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mb35v2qw2u2r...

CVE-2025-15135

creationtimestamp| type| source ---|---|--- 2025-12-28 12:28:46+00:00| seen| https://bsky.app/profile/potato.software/post/3mb2d4cebvj2p...

[SECURITY] Fedora 42 Update: gdu-5.32.0-1.fc42

Fast disk usage analyzer with console interface written in Go...

PT-2025-53647

Name of the Vulnerable Software and Affected Versions ZSPACE Z4Pro+ version 1.0.0440024 Description A flaw exists in ZSPACE Z4Pro+ that allows for command injection. The issue is located within the zfilev2 api open function, accessible through the /v2/file/safe/open endpoint of the HTTP POST...