PT-2025-30940 · Tera Insights · Ticrypt

Name of the Vulnerable Software and Affected Versions: tiaudit versions prior to 2025-07-17 Description: tiaudit in Tera Insights tiCrypt allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries and database structure. Recommendations: Update...

CVE-2025-47696

creationtimestamp| type| source ---|---|--- 2025-07-24 21:02:21+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3luqgm4weme2f 2025-08-31 06:01:58+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3lxofz2po7j24 2025-08-31 06:50:06+00:00| seen|...

CVE-2025-6260 Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset us...

CVE-2025-8114

creationtimestamp| type| source ---|---|--- 2025-07-24 14:32:16+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114908694803642637 2025-09-19 18:51:31+00:00| seen| https://gist.github.com/EbonJaeger/2ba8ad95fbe2fa2ac2e44b74f6abfe47 2025-11-03 06:19:06+00:00| seen|...

CVE-2025-8040

creationtimestamp| type| source ---|---|--- 2025-07-24 12:26:21+00:00| seen| https://poliverso.org/objects/0477a01e-5811f83d-175e754718197297 2026-04-13 17:57:07+00:00| published-proof-of-concept| Telegram/X7VHG2-47Qhhj8GB65kRLNGPkxuaTLxPWX3Bbqfyik...

CVE-2025-3947

creationtimestamp| type| source ---|---|--- 2025-07-24 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-03...

CVE-2025-2520

creationtimestamp| type| source ---|---|--- 2025-07-24 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-03...

CVE-2025-54377 Roo Code Lacks Line Break Validation in its Command Execution Tool

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks \n in its command input, allowing potential bypass of the allow-list mechanism. The project appears to lack parsing or validation logic to prevent...

CVE-2025-53537 LibHTP's memory leak with lzma can lead to resource starvation

LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak that can starve the process of memory, leading to loss of visibility. To workaround this issue, set suricata.yaml...

CVE-2025-8058

The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation...

CVE-2025-54138

creationtimestamp| type| source ---|---|--- 2025-07-23 16:47:07+00:00| seen| https://bsky.app/profile/undercode.bsky.social/post/3lunhurzsib2x...

CVE-2015-10141

An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans. When remote debugging is enabled, Xdebug listens on port 9000 and accepts debugger protocol commands without authentication. An attacker ca...

CVE-2025-41675

A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...

CVE-2025-54447

Unrestricted Upload of File with Dangerous Type vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

CVE-2025-54453

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

CVE-2025-8021

All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory...

CVE-2025-44109

A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages...

CVE-2025-8031

The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...

CVE-2025-8036 DNS rebinding circumvents CORS

Thunderbird cached CORS preflight responses across IP address changes. This allowed circumventing CORS with DNS rebinding. This vulnerability was fixed in Firefox 141, Firefox ESR 140.1, Thunderbird 141, and Thunderbird 140.1...

CVE-2022-44693

creationtimestamp| type| source ---|---|--- 2025-07-22 17:56:06+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3lul3b7pvly2r 2025-07-23 02:38:03+00:00| seen| https://bsky.app/profile/secqube.com/post/3lulygkmf7m2l 2026-07-26 02:02:34+00:00| seen| https://t.me/EchelonEyes/975...