CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler

There is an issue in CPython when using bytes.decode"unicodeescape", error="ignore|replace". If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode call in ...

CVE-2025-31947 Repeated LDAP login failures can lock an LDAP account

Mattermost versions 10.6.x = 10.6.1, 10.5.x = 10.5.2, 10.4.x = 10.4.4, 9.11.x = 9.11.11 fail to lockout LDAP users following repeated login failures, which allows attackers to lock external LDAP accounts through repeated login failures through Mattermost...

CVE-2025-40577

A vulnerability has been identified in SCALANCE LPE9403 6GK5998-3GS00-2AC2 All versions V4.0 HF0. Affected devices do not properly validate incoming Profinet packets. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted malicious packet, which leads to a crash o...

CVE-2024-51444

A vulnerability has been identified in Polarion V2310 All versions, Polarion V2404 All versions V2404.4. The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization...

CVE-2025-32002

creationtimestamp| type| source ---|---|--- 2025-05-15 09:33:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16460 2025-05-15 11:02:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp7ehw6xns2o 2025-05-20 20:51:43+00:00| seen|...

CVE-2025-32738

creationtimestamp| type| source ---|---|--- 2025-05-15 09:33:14+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16459 2025-05-15 11:03:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lp7ehwcnt22o 2025-05-20 20:51:43+00:00| seen|...

CVE-2025-41645

An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake...

CVE-2025-32738

Missing authentication for critical function issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier. If exploited, a remote unauthenticated attacker may change the product settings...

WordPress File Manager Advanced Shortcode PRO plugin <= 2.5.6 - Authenticated (Administrator+) Local JavaScript File Inclusion via Shortcode vulnerability

Authenticated Administrator+ Local JavaScript File Inclusion via Shortcode vulnerability discovered by TANG Cheuk Hei siunam in WordPress Plugin File Manager Advanced Shortcode PRO versions = 2.5.6...

CVE-2025-27523 XXE vulnerability in JP1/IT Desktop Management 2 - Smart Device Manager

XXE vulnerability in Hitachi JP1/IT Desktop Management 2 - Smart Device Manager on Windows.This issue affects JP1/IT Desktop Management 2 - Smart Device Manager: from 12-00 before 12-00-08, from 11-10 through 11-10-08, from 11-00 through 11-00-05, from 10-50 through 10-50-06...

CVE-2025-20003

creationtimestamp| type| source ---|---|--- 2025-05-15 04:32:33+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16438...

CVE-2025-4589 Bon Toolkit <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bon Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt-map' shortcode in all versions up to, and including, 1.3.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-4579 WP Content Security Plugin <= 2.3 - Unauthenticated Stored Cross-Site Scripting via CSP-Report Fields

The WP Content Security Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blocked-uri and effective-directive parameters in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-46397

In xfig diagramming tool, a stack-overflow while running fig2dev allows memory corruption via local input manipulation at the bezierspline function...

CVE-2025-43007

SAP Service Parts Management SPM does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This has low impact on confidentiality, integrity and availability of the application...

CVE-2025-30009

he Live Auction Cockpit in SAP Supplier Relationship Management SRM uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to execute malicious script in the victim�s browser. This vulnerability has low impact on confidentiality and...

CVE-2025-43010

SAP S/4HANA Cloud Private Edition or on Premise SCM Master Data Layer MDL allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. This is due to lack of input validation an...

CVE-2025-23166

creationtimestamp| type| source ---|---|--- 2025-05-15 01:06:34+00:00| seen| https://bsky.app/profile/bluesky.awakari.com/post/3lp6d5gqzx327 2025-05-15 15:30:27+00:00| seen| https://bsky.app/profile/socket.dev/post/3lp7tg66eps2l 2025-05-15 22:42:10+00:00| seen|...

CVE-2024-56526

An issue was discovered in OXID eShop before 7. CMS pages in combination with Smarty may display user information if a CMS page contains a Smarty syntax error...

CVE-2024-52880

An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver,...