CVE-2025-48996

HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the haxPsuUsage API endpoint, related to a flat...

CVE-2025-46339 FreshRSS vulnerable to favicon cache poisoning via proxy

FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, it's possible to poison feed favicons by adding a given URL as a feed with the proxy set to an attacker-controlled one and disabled SSL verifying. The favicon hash is computed by hashing the feed URL and the salt, whilst not...

CVE-2025-20286

A vulnerability in Amazon Web Services AWS, Microsoft Azure, and Oracle Cloud Infrastructure OCI cloud deployments of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configuration...

CVE-2016-2781

creationtimestamp| type| source ---|---|--- 2025-06-04 10:36:08+00:00| seen| https://gist.github.com/oilbeater/19267d83a35f59ccdec924097fb0bf30 2025-06-09 16:56:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17713 2025-11-18 19:05:17+00:00| seen|...

CVE-2025-20995

creationtimestamp| type| source ---|---|--- 2025-06-04 05:41:54+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqr3se6f2xu2 2025-06-04 07:30:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqrbx3avlk2e...

CVE-2025-25179

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages...

CVE-2025-20993

Out-of-bounds write in libsecimaging.camera.samsung.so prior to SMR Jun-2025 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2025-5561 PHPGurukul Curfew e-Pass Management System view-pass-detail.php sql injection

A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/view-pass-detail.php. The manipulation of the argument viewid leads to sql injection. The attack can be...

CVE-2025-5539 Simplify Contact Management: WP Easy Contact <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Simple Contact Form Plugin for WordPress – WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'emdmbmeta' shortcode in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping on user supplied attribute...

CVE-2025-5572

creationtimestamp| type| source ---|---|--- 2025-06-04 04:10:08+00:00| seen| https://infosec.exchange/users/vuldb/statuses/114623132967155830 2025-06-04 06:30:12+00:00| published-proof-of-concept| Telegram/7hi-ihBg5MmYecGDPwXbjh1NxIa20ZfUfMMGhYgT9Tm5Kl8 2025-06-04 07:23:55+00:00| seen|...

CVE-2025-48951

creationtimestamp| type| source ---|---|--- 2025-06-04 00:41:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqql3p4lyu2s 2025-06-05 05:03:58+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lqtk7bbq742s 2025-06-08 02:22:40+00:00| seen|...

SUSE: Security Advisory (SUSE-SU-2024:2571-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-35036 hibernate-validator insecure default Expression Language interpolation

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

CVE-2025-22233 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, apache-nifi, thingsboard...

CVE-2025-31359

A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 55879. This vulnerability can be exploited by an attacker to write to arbitrary files, potentially leading to privilege escalation...

CVE-2025-45855

An active CVE exists for erupt v1.12.19: arbitrary file upload in the /upload/GoodsCategory/image component can lead to code execution. The root cause is an unsecured upload endpoint that accepts crafted files, enabling an attacker to execute arbitrary code on the host. MITRE/attack details are n...

CVE-2025-47827

creationtimestamp| type| source ---|---|--- 2025-06-02 19:34:29+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/39027 2025-06-05 14:39:23+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lqukdrxqfni2 2025-06-05 14:59:07+00:00...

CVE-2025-48994 SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-48994

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...