CVE-2025-5893

Smart Parking Management System from Honding Technology has an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access a specific page and obtain plaintext administrator credentials...

CVE-2025-47711

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error,...

CVE-2025-25207

The Authorino service in the Red Hat Connectivity Link is the authorization service for zero trust API security. Authorino allows the users with developer persona to add callbacks to be executed to HTTP endpoints once the authorization process is completed. It was found that an attacker with...

CVE-2025-5875

creationtimestamp| type| source ---|---|--- 2025-06-08 18:07:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114649073412244468 2025-06-09 12:01:36+00:00| seen| Telegram/bTJ9s6Dm5c98HBwnHhlVxkUI4b7kIVaieHQvre00jyC9A 2025-06-12 19:33:50+00:00| published-proof-of-concept|...

CVE-2025-21082

creationtimestamp| type| source ---|---|--- 2025-06-08 15:15:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lr45s7clwk2k...

CVE-2025-5762

A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file viewhematology.php. The manipulation of the argument itrno leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-30954

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through = 1.1.0...

CVE-2025-30978

Missing Authorization vulnerability in Dor Zuberi Slack Notifications by dorzki dorzki-notifications-to-slack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slack Notifications by dorzki: from n/a through = 2.0.7...

CVE-2025-41361

Uncontrolled resource consumption vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. The devices improperly handle TLS requests associated with PROCOME sockets, so TLS requests sent to those PROCOME ports could cause the device to reboot and result in a denial of service. To exploit th...

CVE-2025-27242 Ssecurity_component_manager has an improper input vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input...

CVE-2025-38004

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcmop runtime updates The CAN broadcast manager CAN BCM can send a sequence of CAN frames via hrtimer. The content and also the length of the sequence can be changed resp reduced at runtime where the...

CVE-2025-38003

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is generated for a bcmop which is in the process to be removed the procfs output might show unreliable data UAF. As the removal of bcmop's is...

CVE-2025-38003

The CVE-2025-38003 issue affects the Linux kernel BCM CAN component where procfs content generation for a bcm_op being removed lacked proper rcu_read_lock protection, risking unreliable data in procfs (use-after-free style) due to missing rcu handling. A patch adds the missing rcu_read_lock() and...

CVE-2025-5568 WpEvently <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-5399 WebSocket endless loop

Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop. There is no other way for the application to escape or exit this loop other than killing the thread/process. This might be used to DoS...

BELL-CVE-2025-38000

Bulletin has no description...

CVE-2025-47601

creationtimestamp| type| source ---|---|--- 2025-06-07 05:00:22+00:00| seen| Telegram/rvYzq3XuSqIS6Jq2gKTARck8Jdf3ZePMyR6aO0nPIgKoa34 2025-06-07 06:48:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqyqy4kql72e...

CVE-2024-55585

CVE-2024-55585 affects moPS App up to version 1.8.618. The vulnerability stems from insufficient access control on administrative API endpoints, allowing unauthenticated users to perform read and write actions (example: /api/v1/users/resetpassword). The CVSS shows high impact with confidentialiti...

CVE-2025-5788

CVE-2025-5788 affects TOTOLINK X15 (version 1.0.0-B20230714.1105). The vulnerability is a buffer overflow in the HTTP POST Request Handler, triggered by manipulating the submit-url argument in /boafrm/formReflashClientTbl. A remote attacker may exploit this, with some sources indicating PoC/explo...

CVE-2025-22486

An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who have gained user access to compromise the security of the system. We have already fixed the vulnerability in the following versions: File...