23691 matches found
CVE-2025-324632
creationtimestamp| type| source ---|---|--- 2025-07-08 02:01:05+00:00| seen| https://bsky.app/profile/dustymabe.fosstodon.org.ap.brid.gy/post/3ltg7ecuva252...
CVE-2025-20685
In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote proximal/adjacent code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00416226; Issue ID: MSV-3409...
CVE-2025-6244
CVE-2025-6244 affects the WordPress plugin “Essential Addons for Elementor” (Lite) up to version 6.1.19. The vulnerability is a Stored Cross‑Site Scripting (XSS) flaw in the Calendar and Business Reviews widgets caused by insufficient input sanitization and output escaping. Attacker capability re...
CVE-2025-42974
creationtimestamp| type| source ---|---|--- 2025-07-08 01:18:50+00:00| seen| Telegram/mUGVOx7FJ9FBD1JzuWVDhHY4SpoV7VAXtSrMpoNK4Y1Grx4...
CVE-2025-42980
CVE-2025-42980 affects SAP NetWeaver Enterprise Portal Federated Portal Network. The initial and linked sources describe an insecure deserialization vulnerability where a privileged user can upload untrusted or malicious content, which, when deserialized, can compromise confidentiality, integrity...
CVE-2025-42979
The CVE-2025-42979 entry concerns GuiXT, which is integrated with SAP GUI for Windows. The vulnerability stems from using obfuscation algorithms instead of secure symmetric ciphers to store RFC user credentials on the client PC, residing in the Windows user registry hive. This leads to a confiden...
CVE-2025-42962 Cross-Site Scripting (XSS) vulnerability in SAP Business Warehouse (Business Explorer Web 3.5 loading animation)
SAP Business Warehouse Business Explorer Web allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is n...
PT-2025-28424 · Undefined · Undefined
CVE-2025-53615 Rejected reason https://t.co/8Lmn9NEBkt Vulnerability Notification: https://t.co/xhLrNnfyrO...
PT-2025-28426 · Undefined · Undefined
CVE-2025-53617 Rejected reason https://t.co/4W7JtMJDzr...
PT-2025-28423 · Undefined · Undefined
CVE-2025-53614 Rejected reason https://t.co/vTaxcxo1bh...
CVE-2025-53495
creationtimestamp| type| source ---|---|--- 2025-07-07 23:56:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltfyfq5q6m25...
CVE-2025-7142
creationtimestamp| type| source ---|---|--- 2025-07-07 23:32:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltfx23ptrf2y...
CVE-2025-20300
creationtimestamp| type| source ---|---|--- 2025-07-07 20:11:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltflt3tos42f...
CVE-2024-37657
creationtimestamp| type| source ---|---|--- 2025-07-07 19:22:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ltfj3arpgx2w...
CVE-2025-20321
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an unauthenticated attacker can send a specially-crafted SPL search that could change the membership state in a Splunk Search Head Cluster SHC...
CVE-2025-53530
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to...
CVE-2024-25178
LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in ljstate.c...
CVE-2025-53376 Dokploy allows attackers to run arbitrary OS commands on the Dokploy host.
Dokploy is a self-hostable Platform as a Service PaaS that simplifies the deployment and management of applications and databases. An authenticated, low-privileged user can run arbitrary OS commands on the Dokploy host. The tRPC procedure docker.getContainersByAppNameMatch interpolates the...
CVE-2025-53373 Natours has a 1 Click Account take over on reset password via Host Header injection
Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the /forgetpassword endpoint. This vulnerability is fixed with commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b...