CVE-2025-49132

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...

CVE-2025-6302

A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack...

CVE-2025-49175

creationtimestamp| type| source ---|---|--- 2025-06-23 06:45:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19185 2025-07-25 14:06:31+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lus7tfng4s2f 2026-06-30 01:30:56+00:00| seen|...

Important: libarchive

Issue Overview: A vulnerability has been identified in the libarchive library, specifically within the archivereadformatrarseekdata function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerability can result in memory...

CVE-2025-52921

Innoshop up to version 0.4.1 contains a server-side code execution flaw in the File Manager of the admin panel. An authenticated attacker can upload a crafted file and bypass the image-only check by renaming the file to a .php extension (renaming function), enabling a subsequent GET request to ex...

CVE-2023-47031

An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to escalate privileges via a crafted POST request to the grantRolesToUsers, grantRolesToGroups, and grantRolesToOrganization SOAP API component...

CVE-2025-52967

MLflow prior to 3.1.0 is affected by a gateway_proxy_handler issue that lacks gateway_path validation, enabling potential SSRF via gateway routes. The CVE-2025-52967 description specifies a missing validation in gateway_proxy_handler, with CVSSv3.1 vector indicating network attack, low complexity...

CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

CVE-2023-47029

A security vulnerability exists in NCR Terminal Handler v.1.5.1 (also referred to as NCR Atleos Terminal Handler ) involving the UserService component. A remote attacker can exploit this issue by sending a crafted POST request , which leads to the execution of arbitrary code and unauthorized acce...

CVE-2025-52926

In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...

CVE-2025-6490

A vulnerability was found in sparklemotion nokogiri c29c920907366cb74af13b4dc2230e9c9e23b833 and classified as problematic. This issue affects the function hashmapsetwithhash of the file gumbo-parser/src/hashmap.c. The manipulation leads to heap-based buffer overflow. An attack has to be approach...

CVE-2025-6486

A vulnerability was found in TOTOLINK A3002R 1.1.1-B20200824.0128. It has been declared as critical. This vulnerability affects the function formWlanMultipleAP of the file /boafrm/formWlanMultipleAP. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack can ...

CVE-2025-6485

creationtimestamp| type| source ---|---|--- 2025-06-22 17:48:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19170 2025-06-22 18:07:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls7nwqp5fy2v 2026-01-23 21:03:05+00:00| seen|...

CVE-2025-6483

creationtimestamp| type| source ---|---|--- 2025-06-22 16:47:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19168 2025-06-22 17:00:54+00:00| published-proof-of-concept| Telegram/Vnx5KCxrPRsIbvdxVRTilkI3AMzgNQPcLDF6vvBNNJ6bMY 2025-06-22 18:22:13+00:00| seen|...

CVE-2025-6481

creationtimestamp| type| source ---|---|--- 2025-06-22 15:46:00+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19166 2025-06-22 16:01:26+00:00| published-proof-of-concept| Telegram/JXdIHA4NW6c606ZHTElBxltbVcdKBOZ3nM5pnGiNcLowVzU 2025-06-22 18:37:14+00:00| seen|...

CVE-2025-6466 ageerle ruoyi-ai SseServiceImpl.java upload unrestricted upload

A vulnerability was found in ageerle ruoyi-ai 2.0.0 and classified as critical. Affected by this issue is the function speechToTextTranscriptionsV2/upload of the file ruoyi-modules/ruoyi-system/src/main/java/org/ruoyi/system/service/impl/SseServiceImpl.java. The manipulation of the argument File...

CVE-2025-6458

creationtimestamp| type| source ---|---|--- 2025-06-22 04:43:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19149 2025-06-22 06:01:12+00:00| published-proof-of-concept| Telegram/56s6aSE0cEqYXGXE607m6A-Qk9CW0ThgSANdwVW84nL4 2025-06-22 08:13:42+00:00| seen|...

CVE-2025-6452

creationtimestamp| type| source ---|---|--- 2025-06-22 02:46:44+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19145 2025-06-22 04:20:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ls67pwod5m2m...

CVE-2025-6449

creationtimestamp| type| source ---|---|--- 2025-06-22 00:44:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19142 2025-06-22 01:31:39+00:00| published-proof-of-concept| Telegram/p8F798LSCV2sUyCA6ioZ8hbl6YMhZj0eqwyIGuUlAdEidAo 2025-06-22 04:35:55+00:00| seen|...

CVE-2025-6447

creationtimestamp| type| source ---|---|--- 2025-06-21 23:43:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19134 2025-06-22 00:31:29+00:00| published-proof-of-concept| Telegram/P0ZoWuZyzgcHSriI8XLEqNA0BhqBJCacVToDJc5Op8l1c 2025-06-22 04:11:36+00:00| seen|...