CVE-2025-41698 Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization

A low privileged local attacker can interact with the affected service although user-interaction should not be allowed...

CVE-2025-54794

creationtimestamp| type| source ---|---|--- 2025-08-05 07:07:33+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3lvn5kfzyyo2m 2025-08-06 15:00:07+00:00| published-proof-of-concept| Telegram/ihOkiwe6OhHQI2TZ1X3ddAGzem4yCBX0qBNzRmX2HDnWoU 2025-08-07 11:48:51+00:00| seen|...

CVE-2025-8547

CVE-2025-8547 affects atjiu pybbs up to 6.0.0, impacting the Email Verification Handler. The vulnerability enables improper authorization and can be exploited remotely. Public exploit information is noted, and a patch is identified as 044f22893bee254dc2bb0d30f614913fab3c22c2. Remediation guidance...

CVE-2025-8634

creationtimestamp| type| source ---|---|--- 2025-08-05 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-782/...

CVE-2025-8630

creationtimestamp| type| source ---|---|--- 2025-08-05 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-778/...

CVE-2025-54119

ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping of a query parameter may allow an attacker to execute arbitrary SQL statements when the code using ADOdb connects to a sqlite3 database a...

CVE-2025-8584

A vulnerability classified as problematic was found in libav up to 12.3. Affected by this vulnerability is the function avbufferunref of the file libavutil/buffer.c of the component AVI File Parser. The manipulation leads to null pointer dereference. Local access is required to approach this...

ncurses security update

6.2-10.20210508.el96.2 - remove execute permissions from ANNOUNCE file RHEL-102738 6.2-10.20210508.el96.1 - guard against corrupt terminfo data in string conversion CVE-2022-29458 RHEL-100139...

CVE-2025-8530 elunez eladmin Druid application-prod.yml default credentials

A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the file eladmin-system\src\main\resources\config\application-prod.yml of the component Druid. The manipulation of the argument...

CVE-2025-44963

RUCKUS Network Director RND before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key...

CVE-2025-8513 Caixin News App com.caixin.news AndroidManifest.xml improper export of android application components

A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifest.xml of the component com.caixin.news. The manipulation leads to improper export of android application components. Local access is...

CVE-2025-52361

Insecure permissions in the script /etc/init.d/lighttpd in AK-Nord USB-Server-LXL Firmware v0.0.16 Build 2023-03-13 allows a locally authenticated low-privilege user to execute arbitrary commands with root privilege via editing this script which is executed with root-privileges on any interaction...

CVE-2025-8510

A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educarmatriculalst.php. The manipulation of the argument refcodaluno leads to cross site scripting. It is possible to initiate the attack remotely. Th...

CVE-2025-8506

A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has...

CVE-2025-8506

The CVE-2025-8506 entry describes wx-shop (up to de1b66331368695779cfc6e4d11a64caddf8716e) with a vulnerability in the file /user/editUI that allows cross-site scripting. The underlying issue is a manipulation in processing that enables XSS, with remote initiation and a publicly disclosed exploit...

CVE-2025-23284

creationtimestamp| type| source ---|---|--- 2025-08-03 04:31:36+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lvhtvpyzx42s...

CVE-2023-32253

A flaw was found in the Linux kernel's ksmbd component. A deadlock is triggered by sending multiple concurrent session setup requests, possibly leading to a denial of service...

CVE-2025-50870

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. The myds GET parameter accepts an email address as input and directly returns the corresponding student's personal information without validating the identity or permissions of the...

CVE-2025-53011

MaterialX CVE-2025-53011 is a NULL pointer dereference in MaterialXCore while parsing MTLX shader nodes. The bug occurs in 1.39.2 due to not checking implGraphOutput for null, enabling a crafted MTLX file to crash affected programs. Remediation is to upgrade to MaterialX 1.39.3 (or newer). A PoC ...

CVE-2025-45767

jose v6.0.10 was discovered to contain weak encryption. NOTE: this is disputed by a third party because the claim of "do not meet recommended security standards" does not reflect guidance in a final publication...