CVE-2025-47279

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, th...

CVE-2025-30329

Animate versions 24.0.8, 23.0.11 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption of service. Exploitation of this issue requires user...

CVE-2025-48024

In BlueWave Checkmate before 2.1, an authenticated regular user can access sensitive application secrets via the /api/v1/settings endpoint...

CVE-2025-24026

CVE-2025-24026 concerns iTop, a web-based ITSM tool. Versions prior to 3.2.1 are vulnerable to a regular expression denial of service (ReDoS) that may affect the iTop server under certain circumstances; the issue stems from using an affected variable in a regex. Version 3.2.1 does not use the vul...

Samsung libsavscmn Memory Corruption Vulnerability

Samsung libsavscmn is a cell phone application from the South Korean company Samsung SAMSUNG. A memory corruption vulnerability exists in Samsung libsavscmn, which can be exploited by attackers to cause memory corruption...

GNU PSPP Denial of Service Vulnerability

GNU PSPP is an application for data sampling, statistics and analysis. A denial of service vulnerability exists in GNU PSPP, which can be exploited by an attacker to cause assertion failures and application exits...

CVE-2024-51445

CVE-2024-51445 affects Siemens Polarion: Polarion V2310 (All versions) and Polarion V2404 (All versions

CVE-2025-4529

A vulnerability was found in Seeyon Zhiyuan OA Web Application System 8.1 SP2. It has been classified as problematic. Affected is the function Download of the file...

CVE-2023-49641

creationtimestamp| type| source ---|---|--- 2025-05-13 00:47:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lozb4rspe42p 2025-05-13 02:59:49+00:00| seen| https://t.me/cvedetector/25137 2025-05-13 14:30:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16131...

CVE-2025-4529

CVE-2025-4529 affects Seeyon Zhiyuan OA Web Application System 8.1 SP2. The vulnerability lies in the Download function of the ZIP File Handler within seeyon-apps-m3.jar (M3CoreController.class): manipulating the Name argument enables path traversal. Remote exploitation is possible and the exploi...

CVE-2025-28202

creationtimestamp| type| source ---|---|--- 2025-05-09 18:32:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lor2rsi53z2o 2025-05-09 20:23:32+00:00| seen| https://t.me/cvedetector/24965...

CVE-2024-58098

creationtimestamp| type| source ---|---|--- 2025-05-05 16:16:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3logrd7ubfp2w 2025-05-09 08:25:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/15705 2026-03-19 00:00:00+00:00| seen|...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

CVE-2025-27921

CVE-2025-27921 is a reflected XSS in Output Messenger prior to version 2.0.63 where user input is reflected in the web app response. Affected product: Output Messenger (client/web component). Mitigations reported: upgrade to version 2.0.63 or later; no exploitation of this CVE has been observed b...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint

Summary The OAuth implementation failed to check that redirecturi was among the allowed set for the clientid. Impact Under certain circumstances see below, if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visitin...

PHPGurukul Boat Booking System 注入漏洞

PHPGurukul Boat Booking System is a boat booking system from PHPGurukul. An injection vulnerability exists in version 1.0 of the PHPGurukul Boat Booking System, which stems from SQL injection due to incorrect manipulation of the parameter ID in the file /admin/change-image.php...

CVE-2025-24343

A vulnerability in the “Manages app data” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to write arbitrary files in arbitrary file system paths via a crafted HTTP request...

CVE-2025-24339

CVE-2025-24339 involves the web application of ctrlX OS. The vulnerability allows a remote, unauthenticated attacker to perform various attacks against users of the vulnerable system, including web cache poisoning and Man-in-the-Middle (MitM) via a crafted HTTP request. The CVSS 3.1 base metrics ...

Unspecified Vulnerability in Tenable Network Security Nessus

Tenable Network Security Nessus is a network vulnerability scanning tool developed by Tenable Network Security to detect security vulnerabilities and configuration errors in operating systems, network devices, and applications. Tenable Network Security Nessus contains a security vulnerability tha...