CVE-2025-21576

...

CVE-2025-21574

CVE-2025-21574 affects Oracle MySQL Server (Server: Parser) across 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0, allowing a low-privilege, network-based attacker to cause a hang or crash (DoS). Connected sources confirm the parser component as the vulnerable element and note an exploitation demonst...

CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-31949 Growatt Cloud portal Authorization Bypass Through User-Controlled Key

An authenticated attacker can obtain any plant name by knowing the plant ID...

CVE-2025-32012

Summary: CVE-2025-32012 affects Jellyfin versions 10.9.0 through 10.10.6, where the "/System/Restart" admin endpoint can be spoofed to restart the server by unauthenticated attackers on the same LAN, due to how the source IP is determined. Impact: Unauthenticated DoS against default-configured Je...

CVE-2025-1122

Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NVRead functionality during the Challenge-Response process...

CVE-2025-28399

An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class...

CVE-2024-42200

creationtimestamp| type| source ---|---|--- 2025-04-15 18:44:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmuqalxy2g2q 2025-04-15 21:37:50+00:00| seen| https://t.me/cvedetector/22989...

CVE-2023-5616

In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user...

WordPress Feedify – Web Push Notifications plugin <= 2.4.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Feedify – Web Push Notifications versions = 2.4.5...

CVE-2025-29280

creationtimestamp| type| source ---|---|--- 2025-04-15 16:38:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujatnbuo2h 2025-04-15 17:26:33+00:00| seen| https://t.me/cvedetector/22955...

CVE-2025-32949

creationtimestamp| type| source ---|---|--- 2025-04-15 16:16:28+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114342873544094183 2025-04-15 19:57:11+00:00| seen| https://t.me/cvedetector/22971...

CVE-2025-32911

A use-after-free type vulnerability was found in libsoup, in the soupmessageheadersgetcontentdisposition function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server...

CVE-2025-3522

Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird accesses the specified URL to determine file size, and navigates to it when the user clicks the attachment. Because the URL is not validate...

CVE-2025-3523 User Interface (UI) Misrepresentation of attachment URL

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

CVE-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

CVE-2025-2830

By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when the message is forwarded or edited as a new message. This vulnerability could allow attackers to disclose sensitive information from the...

CVE-2025-32945

creationtimestamp| type| source ---|---|--- 2025-04-15 14:15:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114342397806384726 2025-04-15 16:38:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujasjh7k24 2025-04-15 17:26:34+00:00| seen| https://t.me/cvedetector/229...

CVE-2025-32946

creationtimestamp| type| source ---|---|--- 2025-04-15 14:15:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114342397806384726 2025-04-15 16:38:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujaswq6w2h 2025-04-15 17:26:38+00:00| seen| https://t.me/cvedetector/229...

CVE-2025-32445

A flaw was found in the argo-events package. A user with the permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges...