CVE-2025-6075 affecting package python3 for versions less than 3.12.9-6

CVE-2025-6075 affecting package python3 for versions less than 3.12.9-6. A patched version of the package is available...

CVE-2025-67906

In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path...

CVE-2025-64994

A privilege escalation vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate...

CVE-2025-64781

In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restriction" is set to "Do not limit" in the initial configuration. With this configuration, the user may be redirected to an arbitrary website...

Linux Distros Unpatched Vulnerability : CVE-2025-14332

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory safety bugs present in Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so...

CVE-2024-58300

The CVE-2024-58300 affects Siklu MultiHaul TG series devices before version 2.0.0. An unauthenticated vulnerability allows remote attackers to retrieve randomly generated credentials by sending a specific hex-encoded command to port 12777, yielding the username and password and enabling direct SS...

CVE-2025-64989

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instruction prior V21.1. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands...

CVE-2025-64991 Command Injection in 1E-PatchInsights-Deploy Instruction

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote...

CVE-2025-64991 Command Injection in 1E-PatchInsights-Deploy Instruction

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote...

CVE-2025-64988

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-Nomad-GetCmContentLocations instruction prior V19.2. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables...

PT-2025-50598

A command injection vulnerability was discovered in TeamViewer DEX former 1E DEX, specifically within the 1E-PatchInsights-Deploy instruction prior V15. Improper input validation, allowing authenticated attackers with Actioner privileges to inject arbitrary commands. Exploitation enables remote...

CVE-2025-34392

Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL that is later loaded by the application. This can lead to arbitrary file write and remote code execution via webshell upload...

CVE-2025-10876

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting XSS. This issue affects e-BAP Automation: from 1.8.96 before v.41815...

CVE-2025-5469 Dylib Hijacking in Yandex Messenger

Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245...

CVE-2025-10876 XSS in Talent Software's e-Bap

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting XSS. This issue affects e-BAP Automation: from 1.8.96 before v.41815...

CVE-2025-11022 CSRF in Panilux

Cross-Site Request Forgery CSRF vulnerability in Personal Project Panilux allows Cross Site Request Forgery. This CSRF vulnerability resulting in Command Injection has been identified. This issue affects Panilux: before v.0.10.0. NOTE: The vendor was contacted and responded that they deny...

CVE-2025-40938

SIMATIC CN 4100 (all versions below V4.0.1) contains a vulnerability where sensitive data is stored in the firmware, potentially exposing confidentiality, integrity, and availability. Connected advisories confirm a fix in newer firmware versions (V4.0.1 and later); apply the vendor-released updat...

WordPress plugin Post Cloner 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

CVE-2025-42615

Summary: CVE-2025-42615 affects Vulnerability-Lookup prior to 2.18.0 and stems from failing to rate-limit OTP attempts during 2FA, enabling brute-force style OTP submissions by an attacker with valid credentials. The concrete fix adds a persistent failed_otp_attempts counter, locks a user after 5...

Paessler PRTN Network Monitor < 18.2.39 Multiple Vulnerabilities

The version of Paessler PRTG Network Monitor installed on the remote host is prior to 18.2.39. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with...