CVE-2025-29785

quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to trigger a nil-pointer dereference by a malicious QUIC client. In order to do so, the attacker first sends valid QUIC packets from different...

CVE-2025-5441

Affected devices: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 with firmware versions 1.0.013.001 through 1.2.07.001. Root cause: the function setDeviceURL in /goform/setDeviceURL accepts a DeviceURL argument whose manipulation enables OS command injection. Impact: remote exploitati...

CVE-2025-5455

An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value such as...

CVE-2025-0325

A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour configuration page in the web interface of the Axis device...

CVE-2025-0324

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges...

CVE-2025-5113

creationtimestamp| type| source ---|---|--- 2025-06-02 08:01:07+00:00| published-proof-of-concept| Telegram/MNJNzGAF9bpm-8pO2mYbfB9j1qFTK3WJrzpGubMjm4ci4gI 2025-06-02 08:59:31+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqmfwbzonty2...

CVE-2025-3813

The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘elementordata’ parameter in all versions up to, and including, 1.7.1020 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2025-0324

The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges...

CVE-2025-5113 Authenticated Remote Command Injection in Diviotec NBR IP Cameras

The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used...

CVE-2025-49112

creationtimestamp| type| source ---|---|--- 2025-06-02 06:32:27+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqm5qhndffw2 2025-06-02 08:32:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqmehelfs32p 2025-07-07...

CVE-2025-1485

creationtimestamp| type| source ---|---|--- 2025-06-02 06:31:23+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqm5ogyxvli2 2025-06-02 08:46:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqmfaxn7iq2m...

CVE-2025-49113

creationtimestamp| type| source ---|---|--- 2025-06-02 05:30:34+00:00| published-proof-of-concept| Telegram/uuyPA3gvakwp7Y6MXsDRHU-rReonmLN5TGQiUNAsxQcNXaQ 2025-06-02 06:32:54+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqm5rcedhhm2...

CVE-2025-49112

setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev-size - prev-used...

CVE-2025-25179

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages...

CVE-2025-25179

CVE-2025-25179 is a local vulnerability in the Imagination Technologies PowerVR-GPU driver. A non-privileged user may issue improper GPU system calls that subvert GPU hardware and write to arbitrary physical memory pages. Reported base metrics indicate local access, low privileges required, and h...

CVE-2025-5426

creationtimestamp| type| source ---|---|--- 2025-06-02 04:05:45+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqlvjwinsp62...

CVE-2025-37089

creationtimestamp| type| source ---|---|--- 2025-06-02 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-312/ 2025-06-02 13:42:53+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114614060543344731 2025-06-02 14:00:51+00:00| seen|...

CVE-2025-37095

creationtimestamp| type| source ---|---|--- 2025-06-02 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-318/ 2025-06-02 14:39:35+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqmyxhtirqa2 2025-06-02 17:57:57+00:0...

CVE-2025-20676

In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00412240; Issue ID: MSV-3293...

CVE-2025-5455

An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that contained a "charset" parameter that lacked a value such as...