CVE-2025-43970

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

CVE-2025-43973

GoBGP before 3.35.0 contains an input length check in pkg/packet/rtr/rtr.go that does not verify there are enough bytes to form an RTR message. This can lead to processing issues when handling RTR messages. The issue is fixed in or after GoBGP 3.35.0; affected components are the RTR message handl...

CVE-2025-28103

Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request...

CVE-2025-43928

In Infodraw Media Relay Service MRS 7.1.0.0, the MRS web server on port 12654 allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing...

CVE-2025-43920

GNU Mailman 2.1.39, as bundled in cPanel and WHM, in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metacharacters in an email Subject line. NOTE: multiple third parties report that they are unable to reproduce this, regardles...

CVE-2025-43920

creationtimestamp| type| source ---|---|--- 2025-04-20 01:00:32+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12602 2025-04-20 01:20:20+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ln7iaqp7x4r2 2025-04-20...

CVE-2025-43966

libheif before 1.19.6 has a NULL pointer dereference in ImageItemiden in image-items/iden.cc...

CVE-2025-43928

In Infodraw Media Relay Service MRS 7.1.0.0, the MRS web server on port 12654 allows reading arbitrary files via ../ directory traversal in the username field. Reading ServerParameters.xml may reveal administrator credentials in cleartext or with MD5 hashing...

CVE-2025-43954

QMarkdown aka quasar-ui-qmarkdown before 2.0.5 allows XSS via headers even when when no-html is set...

CVE-2025-43961

In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser...

CVE-2020-36844

KnowBe4 Security Awareness Training is affected by CVE-2020-36844, a reflected XSS in versions before 2020-01-10. The vulnerability arises from a response SCRIPT element that sets window.location.href to a JavaScript URL, enabling an attacker-controlled script reflected in the page. The CVSS base...

CVE-2025-43919

CVE-2025-43919 affects GNU Mailman 2.1.39 bundled with cPanel/WHM. The vulnerability is a directory traversal in the /mailman/private/mailman endpoint, exploitable via a crafted username parameter that can read arbitrary server files (e.g., /etc/passwd). Root cause: insufficient input validation ...

CVE-2025-43967

libheif before 1.19.6 has a NULL pointer dereference in ImageItemGrid::getdecoder in image-items/grid.cc because a grid image can reference a nonexistent image item...

CVE-2025-43964

In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values...

CVE-2025-43919

creationtimestamp| type| source ---|---|--- 2025-04-19 23:20:21+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/33029 2025-04-20 01:00:33+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12603 2025-04-20 01:20:11+00:00| seen|...

CVE-2023-26819

creationtimestamp| type| source ---|---|--- 2025-04-19 22:00:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12600 2025-04-20 00:48:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ln7gixd2in2l 2025-04-20 01:10:35+00:00| seen|...

CVE-2022-47111

7-Zip 22.01 does not report an error for certain invalid xz files, involving block flags and reserved bits. Some later versions are unaffected...

CVE-2025-3819

creationtimestamp| type| source ---|---|--- 2025-04-19 20:43:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ln6ysjoe7k24 2025-04-19 20:59:59+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12598 2025-04-19 23:00:30+00:00| published-proof-of-concept|...

CVE-2025-3818

A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB.processinsertquery of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-3816 westboy CicadasCMS Scheduled Task save os command injection

A vulnerability classified as critical was found in westboy CicadasCMS 2.0. This vulnerability affects unknown code of the file /system/schedule/save of the component Scheduled Task Handler. The manipulation leads to os command injection. The attack can be initiated remotely. The exploit has been...