CVE-2025-50064

...

CVE-2025-50061

CVE-2025-50061 affects Oracle Primavera P6 Enterprise Project Portfolio Management (Web Access component). Affected versions are 20.12.0–20.12.21, 21.12.0–21.12.21, 22.12.0–22.12.19, 23.12.0–23.12.13, and 24.12.0–24.12.4. An attacker with network access via HTTP and with low privileges can exploi...

CVE-2025-30745

...

CVE-2025-30747

CVE-2025-30747 affects Oracle PeopleSoft PeopleTools (PIA Core Technology). The vulnerability exists in PeopleSoft Enterprise PeopleTools components and impacts versions 8.60, 8.61, and 8.62. An unauthenticated attacker who can reach the service over HTTP can exploit this issue to access data rea...

CVE-2025-41236

creationtimestamp| type| source ---|---|--- 2025-07-15 18:53:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114858762801914674 2025-07-16 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1592 2025-07-16 12:20:29+00:00| seen|...

CVE-2025-7657

Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-53895 ZITADEL has broken authN and authZ in session API and resulting session tokens

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission chec...

CVE-2025-6972

Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted CATPRODUCT file...

CVE-2025-34109

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with...

CVE-2025-34109 Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with...

CVE-2025-53891 TIME LINE has Improper File Validation in Upload Section

The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploaded files instruction/message media are not strictly validated for type and size. A user may upload renamed or oversized files that can...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

WordPress Strong Testimonials plugin <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Custom Fields vulnerability discovered by ISMAILSHADOW in WordPress Plugin Strong Testimonials versions = 3.2.11...

CVE-2025-53819

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53820 WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the index.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53623 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the CsvEnumerator class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system wher...

CVE-2025-7028

creationtimestamp| type| source ---|---|--- 2025-07-14 13:45:03+00:00| seen| https://t.me/truesecator/7227 2025-07-15 14:29:23+00:00| seen| https://t.me/SEReborn/5756 2025-07-16 17:11:08+00:00| seen| https://bsky.app/profile/fraustief.bsky.social/post/3lu3vx5gtfk2k 2025-07-16 17:11:11+00:00| seen...

CVE-2025-7563

creationtimestamp| type| source ---|---|--- 2025-07-14 07:35:23+00:00| seen| https://bsky.app/profile/potato.software/post/3ltvutwv7uk2t...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-1220

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...