CVE-2025-49550

creationtimestamp| type| source ---|---|--- 2025-06-25 17:52:47+00:00| seen| https://bsky.app/profile/potato.software/post/3lsh6ihfv5e2h 2025-06-25 18:51:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19511...

CVE-2025-6444

The CVE-2025-6444 entry covers a vulnerability in ServiceStack where the GetErrorResponse method in ServiceStack.Text improperly validates user-supplied data, enabling NTLM credential relay. The flaw derives from a type confusion condition caused by insufficient input validation, allowing a remot...

CVE-2025-52890

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options security.macfiltering, security.ipv4filtering and security.ipv6filtering. This can lead to ARP...

CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49153

The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code...

CVE-2025-52889

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services DHCP, DNS... that partially bypass security options security.macfiltering, security.ipv4filtering and...

CVE-2025-6442 Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

CVE-2025-6616

creationtimestamp| type| source ---|---|--- 2025-06-25 16:47:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19479 2025-06-30 20:26:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114774193882630947...

CVE-2025-52569 GitHub.jl lacks validation for user-provided fields

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the GitHub.repo function, the user can provide any string for the reponame field. These inputs are not validate...

CVE-2025-6435

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability affects Firefox 140 and...

CVE-2025-6434

The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker to trick a user into granting an exception and loading a webpage over HTTP. This vulnerability affects Firefox 140 and Thunderbird 140...

CVE-2025-6432

When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability affects Firefox 140 and Thunderbird 140...

CVE-2025-6613

creationtimestamp| type| source ---|---|--- 2025-06-25 09:47:42+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19431 2025-06-25 14:19:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsgsl3bv542a...

CVE-2024-51982

An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language PJL command that will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device. A malformed PJL variable FORMLINES is set to a non...

CVE-2025-0966

creationtimestamp| type| source ---|---|--- 2025-06-25 03:47:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19416 2025-06-25 06:24:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsfxyz6f3425...

CVE-2025-6660

creationtimestamp| type| source ---|---|--- 2025-06-25 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-443/...

CVE-2025-52921

In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the admin panel to achieve code execution on the server, by uploading a crafted file and then renaming it to have a .php extension by using the Rename Function. This bypasses the initial check that...

CVE-2025-52926

In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...

CVE-2025-25905

Cross-Site Scripting XSS vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter...

CVE-2025-25905

CADClick 1.13.0 and earlier is reported vulnerable to Cross-Site Scripting (XSS) via the tree parameter. The root cause cited in CNNVD/related entries is incorrect manipulation of the tree parameter, enabling remote attackers to inject arbitrary web script or HTML. No exploitation details are pro...