CVE-2025-47226

Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information...

CVE-2024-55069

ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamfreadheader in /libavformat/iamfdec.c...

CVE-2025-4184 PCMan FTP Server QUOTE Command buffer overflow

A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component QUOTE Command Handler. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-4182 PCMan FTP Server BELL Command buffer overflow

A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component BELL Command Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2025-4178

creationtimestamp| type| source ---|---|--- 2025-05-01 22:21:35+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14408 2025-05-02 02:01:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo5q5avwl22l 2025-05-02 03:23:41+00:00| seen|...

CVE-2025-4180

PCMan FTP Server 2.0.7 has a buffer overflow flaw in the TRACE Command Handler. The vulnerability can be triggered remotely and is associated with input length validation failures in that handler, as described across multiple sources (CNVD/CNNVD/RedHat and PT-Software). There is no patch informat...

Security Bulletin: IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to multiple Operator package issues

Summary IBM Watson Speech Services Cartridge v4.8.8 is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below...

CVE-2025-46550

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the /?BazaR endpoint and idformulaire parameter are vulnerable to cross-site scripting. An attacker can use a reflected cross-site scripting attack to steal cookies from an authenticated user by having them click on a malicious link...

CVE-2025-46348

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create and download an archive without being authenticated...

CVE-2024-48905

Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint...

CVE-2025-43595

CVE-2025-43595 describes an insecure filesystem permissions vulnerability in MSP360 Backup 4.3.1.115 where a low-privileged user can execute commands with root privileges in the 'Online Backup' folder. Multiple connected sources corroborate the affected product/version and the root cause (imprope...

CVE-2025-46569

creationtimestamp| type| source ---|---|--- 2025-05-01 20:16:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/14399 2025-05-01 22:01:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lo5cpp4fve22 2025-05-01 22:01:57+00:00| published-proof-of-concept|...

CVE-2025-46631

Improper access controls in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an unauthenticated remote attacker to enable telnet access to the router's OS by sending a /goform/telnet web request...

CVE-2025-46634

Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an unauthenticated attacker to authenticate to the web management portal by collecting credentials from observed/collected traffic. It implements encryption, but not until after...

CVE-2025-3517

Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username...

CVE-2025-44863

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44861

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-46337

creationtimestamp| type| source ---|---|--- 2025-05-01 17:57:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114433867704399481 2025-05-01 20:00:50+00:00| published-proof-of-concept| Telegram/QFVP5TcYkEi5fC3DYhpbJ3tJ8sPusYmL1ImuYd1RRjGW6cE 2025-05-01 20:35:57+00:00| seen|...

CVE-2025-46565 Vite's server.fs.deny bypassed with /. for files under project root

Vite is a frontend tooling framework for javascript. Prior to versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network usi...

CVE-2025-44848

TOTOLINK CA600-PoE V5.3c.6665B20180820 was found to contain a command injection vulnerability in the msgprocess function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...