CVE-2025-52424

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-48728

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-53407 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to obtain secret data or modify memory. We have already fixed the vulnerabili...

CVE-2025-52858 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-48728 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-48726

CVE-2025-48726 affects QNAP QTS and QuTS hero. A NULL pointer dereference vulnerability can be exploited by an attacker who has an administrator account to cause a denial-of-service (DoS). Affected products include QTS and QuTS hero releases prior to the patched versions. The published fix commit...

Red Hat OpenShift AI Flaw Exposes Hybrid Cloud Infrastructure to Full Takeover

A severe security flaw has been disclosed in the Red Hat OpenShift AI service that could allow attackers to escalate privileges and take control of the complete infrastructure under certain conditions. OpenShift AI is a platform for managing the lifecycle of predictive and generative artificial...

Cisco Unified Communications Manager 跨站脚本漏洞

Cisco Unified Communications Manager is a call-processing component of a unified communications system from Cisco USA. The component provides a scalable, distributed, and highly available enterprise IP telephony call processing solution. A cross-site scripting vulnerability exists in Cisco Unifie...

CVE-2025-58384

In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interface...

CVE-2025-59815

CVE-2025-59815 affects Zenitel ICX500 and ICX510 Gateway. The connected sources confirm an authenticated remote code execution in the Billing Administration portal, enabling arbitrary commands with shell access on the underlying system. The impact is device unavailability, and compromised confide...

CVE-2025-59815 Authenticated Remote Code Execution in the Billing Administration portal

This vulnerability allows malicious actors to execute arbitrary commands on the underlying system of the Zenitel ICX500 and ICX510 Gateway, granting shell access. Exploitation can compromise the device’s availability, confidentiality, and integrity...

Zenitel ICX500和Zenitel ICX510 安全漏洞

Zenitel ICX500 and Zenitel ICX510 are both communication and control platforms from Zenitel Norway. A security vulnerability exists in the Zenitel ICX500 and Zenitel ICX510 that originates from a malicious actor having unauthorized access to the Billing Admin endpoint, which could result in readi...

Puppet Enterprise Administration Module（PEADM） 安全漏洞

Puppet Enterprise Administration Module PEADM is an open source Puppet module from Puppet that defines the Bolt program. It is used to automate Puppet Enterprise deployments. A security vulnerability exists in Puppet Enterprise Administration Module PEADM versions 2025.4.0 and 2025.5, which stems...

Mangati NovoSGA 代码注入漏洞

Mangati NovoSGA is a service management system from the Brazilian company Mangati. A code injection vulnerability exists in Mangati NovoSGA version 2.2.9 and earlier, which stems from an incorrect manipulation of the parameter logoNavbar/logoLogin in the file/admin, and could lead to a cross-site...

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication...

CVE-2025-55910

CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in databaseadmin.php...

CVE-2025-10615

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used...

CVE-2022-4980 General Bytes Crypto Application Server (CAS) Unauthenticated Creation of Admin Account via Default-installation/First-admin Page

General Bytes Crypto Application Server CAS beginning with version 20201208 prior to 20220531.38 backport and 20220725.22 mainline contains an authentication bypass in the admin web interface. An unauthenticated attacker could invoke the same URL used by the product's default-installation /...

CVE-2025-59453

Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section...

CVE-2025-23337

The CVE-2025-23337 issue affects NVIDIA HGX & DGX GB200, GB300, B300, involving the HGX Management Controller (HMC). A malicious actor with administrative access on the BMC may access the HMC as an administrator, potentially enabling code execution, denial of service, privilege escalation, inform...