23602 matches found
CVE-2025-4287
creationtimestamp| type| source ---|---|--- 2025-05-05 20:20:14+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14986 2025-05-06 00:15:12+00:00| seen| https://t.me/cvedetector/24501 2025-05-06 00:21:55+00:00| seen|...
CVE-2025-4286
creationtimestamp| type| source ---|---|--- 2025-05-05 20:20:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14980 2025-05-06 00:15:19+00:00| seen| https://t.me/cvedetector/24507 2025-05-06 00:21:59+00:00| seen|...
CVE-2025-4279
creationtimestamp| type| source ---|---|--- 2025-05-05 20:16:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loh6qrskiz22 2025-05-05 21:44:14+00:00| seen| https://t.me/cvedetector/24479 2025-05-05 22:24:58+00:00| seen|...
CVE-2025-45615
Incorrect access control in the /admin/ API of yaoqishan v0.0.1-SNAPSHOT allows attackers to gain access to Admin rights via a crafted request...
CVE-2025-45609
Incorrect access control in the doFilter function of kob latest v1.0.0-SNAPSHOT allows attackers to access sensitive information via a crafted payload...
CVE-2025-45616
Incorrect access control in the /admin/ API of brcc v1.2.0 allows attackers to gain access to Admin rights via a crafted request...
CVE-2025-45607
An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...
CVE-2025-45616
creationtimestamp| type| source ---|---|--- 2025-05-05 19:20:19+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14960 2025-05-06 04:36:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3loi2ntftjh2l...
CVE-2025-46571
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...
CVE-2025-46340
Misskey is an open source, federated social media platform. Starting in version 12.0.0 and prior to version 2025.4.1, due to an oversight in the validation performed in UrlPreviewService and MkUrlPreview, it is possible for an attacker to inject arbitrary CSS into the MkUrlPreview component...
CVE-2025-46553
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects,...
CVE-2024-42212 HCL BigFix Compliance is affected by an improper or missing SameSite attribute
HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery CSRF attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions...
CVE-2025-46553 @misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects,...
CVE-2025-46553 @misskey-dev/summaly Redirect Filter Bypass
@misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main summaly function causes the allowRedirects option to never be passed to any plugins, and as a result, isn't enforced. Misskey will follow redirects,...
CVE-2025-43850 GHSL-2025-020_Retrieval-based-Voice-Conversion-WebUI
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptdir variable takes user input e.g. a path to a model and passes it to the changeinfo function in export.py, which uses it to load the...
CVE-2025-4052
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...
CVE-2025-4050
Out of bounds memory access in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...
CVE-2025-4051
Insufficient data validation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Medium...
CVE-2025-4052
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. Chromium security severity: Low...