CVE-2025-41236

creationtimestamp| type| source ---|---|--- 2025-07-15 18:53:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114858762801914674 2025-07-16 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1592 2025-07-16 12:20:29+00:00| seen|...

CVE-2025-7657

Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2025-53895 ZITADEL has broken authN and authZ in session API and resulting session tokens

ZITADEL is an open source identity management system. Starting in version 2.53.0 and prior to versions 4.0.0-rc.2, 3.3.2, 2.71.13, and 2.70.14, vulnerability in ZITADEL's session management API allows any authenticated user to update a session if they know its ID, due to a missing permission chec...

CVE-2025-6972

Use After Free vulnerability exists in the CATPRODUCT file reading procedure in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025. This vulnerability could allow an attacker to execute arbitrary code while opening a specially crafted CATPRODUCT file...

CVE-2025-34109

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with...

CVE-2025-34109 Panda Security PSEvents.exe Insecure DLL Loading Privilege Escalation

PSEvents.exe in multiple Panda Security products runs hourly with SYSTEM privileges and loads DLL files from a user-writable directory without proper validation. An attacker with low-privileged access who can write DLL files to the monitored directory can achieve arbitrary code execution with...

CVE-2025-53891 TIME LINE has Improper File Validation in Upload Section

The timelineofficial/Time-Line- repository contains the source code for the TIME LINE website. A vulnerability was found in the TIME LINE website where uploaded files instruction/message media are not strictly validated for type and size. A user may upload renamed or oversized files that can...

CVE-2025-53885 Directus doesn't redact sensitive user data when logging via event hooks

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows to handle CRUD events for users it is possible to log the incoming data to console using the "Log to Console" operation and a template...

WordPress Strong Testimonials plugin <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Custom Fields vulnerability discovered by ISMAILSHADOW in WordPress Plugin Strong Testimonials versions = 3.2.11...

CVE-2025-53819

Nix is a package manager for Linux and other Unix systems. Builds with Nix 2.30.0 on macOS were executed with elevated privileges root, instead of the build users. The fix was applied to Nix 2.30.1. No known workarounds are available...

CVE-2025-53820 WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the index.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject...

CVE-2025-53623 Job Iteration API is vulnerable to OS Command Injection attack through its CsvEnumerator class

The Job Iteration API is an an extension for ActiveJob that make jobs interruptible and resumable Versions prior to 1.11.0 have an arbitrary code execution vulnerability in the CsvEnumerator class. This vulnerability can be exploited by an attacker to execute arbitrary commands on the system wher...

CVE-2025-7028

creationtimestamp| type| source ---|---|--- 2025-07-14 13:45:03+00:00| seen| https://t.me/truesecator/7227 2025-07-15 14:29:23+00:00| seen| https://t.me/SEReborn/5756 2025-07-16 17:11:08+00:00| seen| https://bsky.app/profile/fraustief.bsky.social/post/3lu3vx5gtfk2k 2025-07-16 17:11:11+00:00| seen...

CVE-2025-7563

creationtimestamp| type| source ---|---|--- 2025-07-14 07:35:23+00:00| seen| https://bsky.app/profile/potato.software/post/3ltvutwv7uk2t...

CVE-2025-29606

py-libp2p before 0.2.3 allows a peer to cause a denial of service resource consumption via a large RSA key...

CVE-2025-1220

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

CVE-2025-1220

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...

CVE-2025-6491 NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 when parsing XML data in SOAP extensions, overly large 2Gb XML namespace prefix may lead to null pointer dereference. This may lead to crashes and affect the availability of the target server...

CVE-2025-7488

creationtimestamp| type| source ---|---|--- 2025-07-12 20:32:21+00:00| seen| https://bsky.app/profile/potato.software/post/3lts7dg7f452t...

CVE-2025-53864 vulnerabilities

Vulnerabilities for packages: akhq, celeborn, wildfly, spark, nacos-docker, apache-nifi-registry, elasticsearch, dependency-track, camunda-zeebe, tez, apicurio-registry, solr-fips, hadoop-client-modules, flyway, solr, apache-nifi, ranger, nacos, druid...