CVE-2025-22240

Arbitrary directory creation or file deletion. In the findfile method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgtenv” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to...

CVE-2025-22237

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process...

CVE-2024-38822

creationtimestamp| type| source ---|---|--- 2025-06-13 06:58:11+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lrhuc33qatx2 2025-06-13 07:33:23+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18281 2025-06-13 11:38:24+00:00| seen|...

CVE-2024-38825

creationtimestamp| type| source ---|---|--- 2025-06-13 06:57:51+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lrhubrvh2j72 2025-06-13 07:33:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18278 2025-06-13 11:12:00+00:00| seen|...

CVE-2024-38823

creationtimestamp| type| source ---|---|--- 2025-06-13 06:57:50+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lrhubsb4puj2 2025-06-13 07:33:21+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18279 2025-06-13 12:08:44+00:00| seen|...

CVE-2024-38822

CVE-2024-38822 concerns Salt (Salt Master/Minion interaction): multiple methods in the Salt master skip minion token validation, enabling a misbehaving minion to impersonate another. Evidence from connected advisories shows patches fixing Minion token validation and related Salt issues (e.g., SUS...

CVE-2025-5282

creationtimestamp| type| source ---|---|--- 2025-06-13 04:34:37+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18259 2025-06-13 05:25:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhp5tpg2a2k 2025-06-13 09:23:06+00:00| seen|...

CVE-2025-5841

creationtimestamp| type| source ---|---|--- 2025-06-13 02:34:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18251 2025-06-13 05:30:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhpgs6cax2s...

CVE-2025-5928

CVE-2025-5928 : The WP Sliding Login/Dashboard Panel plugin for WordPress (versions ≤ 2.1.1) is reported vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the wp_sliding_panel_user_options() function. This enables unauthenticated attackers to update plugin s...

CVE-2025-4586 IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-5233

CVE-2025-5233 affects the WordPress Color Palette plugin. A Stored XSS vulnerability exists via the hex parameter in all versions up to 4.3.2, exploitable by authenticated attackers with Contributor-level access and above to inject scripts on pages viewed by users. The issue stems from insufficie...

CVE-2025-45985

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain a command injection vulnerability via the bsSetSSIDHide function...

Fedora: Security Advisory (FEDORA-2025-49ae47f4ef)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-28384

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal...

CVE-2025-45984

Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100AZ3 V1.0.4, BL-X10AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200AT1 V1.0.0, BL-X26AC8 V1.2.8, BLAC450MAE4 V4.0.0 and BL-X26DA3 V1.2.7 were discovered to contain a command injection vulnerability via the routepwd parameter in the sub45B238 functio...

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack...

CVE-2025-45988

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...

CVE-2025-32717

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2025-44091

creationtimestamp| type| source ---|---|--- 2025-06-12 21:34:41+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18234 2025-06-13 01:07:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhaph3p732p...

CVE-2025-49589

PCSX2 is a free and open-source PlayStation 2 PS2 emulator. A stack-based buffer overflow exists in the KprintfHLE function of PCSX2 versions up to 2.3.414. Opening a disc image that logs a specially crafted message may allow a remote attacker to execute arbitrary code if the user enabled IOP...