CVE-2025-47793 Nextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file

Nextcloud Server is a self hosted personal cloud system, and the Nextcloud Groupfolders app provides admin-configured folders shared by everyone in a group or team. In Nextcloud Server prior to 30.0.2, 29.0.9, and 28.0.1, Nextcloud Enterprise Server prior to 30.0.2 and 29.0.9, and Nextcloud...

CVE-2025-4211

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2025-4211

Improper Link Resolution Before File Access 'Link Following' vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerability arises from the use of the GetTempPa...

CVE-2024-40120

seaweedfs v3.68 was discovered to contain a SQL injection vulnerability via the component /abstractsql/abstractsqlstore.go...

CVE-2025-47436

Heap-based Buffer Overflow vulnerability in Apache ORC. A vulnerability has been identified in the ORC C++ LZO decompression logic, where specially crafted malformed ORC files can cause the decompressor to allocate a 250-byte buffer but then attempts to copy 295 bytes into it. It causes memory...

WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Tran Nguyen Bao KhanhVCI - VNPT in WordPress Plugin CSS3 Accordions for WordPress versions = 3.0...

CVE-2025-37890

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report 1, we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that...

CVE-2025-37890 net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc

In the Linux kernel, the following vulnerability has been resolved: netsched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc As described in Gerrard's report 1, we have a UAF case when an hfsc class has a netem child qdisc. The crux of the issue is that hfsc is assuming that...

CVE-2025-4777

The CVE-2025-4777 entry concerns PHPGurukul Park Ticketing Management System 2.0. Affected component: /view-foreigner-ticket.php. Root cause: manipulation of the viewid parameter enables SQL injection. Impact: potential unauthorized database access, with remote exploitation implied by the descrip...

CVE-2025-40631

creationtimestamp| type| source ---|---|--- 2025-05-16 11:34:52+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16672 2025-05-16 13:03:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpc3nxjvxy2o...

CVE-2025-4679

A vulnerability in Synology Active Backup for Microsoft 365 allows remote authenticated attackers to obtain sensitive information via unspecified vectors...

CVE-2025-48174

A flaw was found in libavif. This vulnerability allows a buffer overflow via a maliciously crafted AVIF file. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment,...

CVE-2025-4516

A vulnerability has been identified in CPython's bytes.decode function when used with the "unicodeescape" encoding and the "ignore" or "replace" error handling modes. This flaw can result in the incorrect decoding of byte strings. While this may not directly lead to traditional security breaches...

CVE-2025-3201

creationtimestamp| type| source ---|---|--- 2025-05-16 06:35:22+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16639 2025-05-16 09:03:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboahtfxw2h...

CVE-2025-4753

CVE-2025-4753 concerns D-Link DI-7003GV2 (firmware 24.04.18D1 R(68125)). The issue is an information disclosure via the /login.data file caused by improper access control, enabling remote attack and exposing sensitive information. Multiple sources confirm the affected product, vulnerability class...

CVE-2025-3877

The Mozilla Foundation's Security Advisory describes the following issue: A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused...

CVE-2025-4752

CVE-2025-4752 – D-Link DI-7003GV2 : Information disclosure via improper access control in the file /install_base.data on DI-7003GV2 (version 24.04.18D1 R(68125)). The vulnerability allows remote exploitation and has public disclosures. Affected component is an unknown functionality within that fi...

CVE-2025-3516 Simple Lightbox < 2.9.4 - Contributor+ Stored XSS

The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-4750

creationtimestamp| type| source ---|---|--- 2025-05-16 05:34:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/16627 2025-05-16 09:03:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpboai654h24...

CVE-2025-47285

A vulnerability has been identified in the Vyper programming language. This flaw can lead to the unintended omission of side effects during string concatenation operations when zero-length bytestring arguments are used. This could result in unexpected or incorrect program behavior, particularly i...