23602 matches found
CVE-2025-7296
IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the...
CVE-2025-53942 authentik has an insufficient check for account active status during OAuth/SAML authentication
authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and earlier, as well as versions 2025.6.0-rc1 through 2025.6.3, deactivated users who registered through OAuth/SAML or linked their accounts to...
CVE-2025-8058
The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation...
CVE-2025-46686
Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server allocates memory for the command arguments of every bulk, even when the command is skipped because of insufficient permissions. NOTE: this i...
CVE-2025-46171
creationtimestamp| type| source ---|---|--- 2025-07-23 16:34:58+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114903514963654205 2025-07-23 18:39:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3luno66kqyw27...
CVE-2025-50127
creationtimestamp| type| source ---|---|--- 2025-07-23 15:06:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3luncbbaroo2w...
CVE-2025-6018
A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...
CVE-2010-10012 httpdASM 0.92 Path Traversal
A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system. By sending a specially crafted GET request containing a sequence of URL-encoded backslashes and directory traversal...
CVE-2016-15045 Deepin lastore-daemon Privilege Escalation via Unsigned .deb Installation
A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux developed by Wuhan Deepin Technology Co., Ltd.. In versions 0.9.53-1 Deepin 15.5 and 0.9.66-1 Deepin 15.7, the D-Bus configuration permits any user in the sudo group to invo...
CVE-2025-53882
creationtimestamp| type| source ---|---|--- 2025-07-23 12:36:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lumzureo3g2h...
CVE-2024-41750
IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data...
CVE-2025-54294
CVE-2025-54294 describes a SQL injection vulnerability in the StackIdeas Komento component for Joomla, affecting versions 4.0.0–4.0.7. The issue allows unprivileged users to execute arbitrary SQL commands. The cited sources consistently tie the flaw to a SQL injection in Komento’s Joomla integrat...
CVE-2025-27930
Zohocorp ManageEngine Applications Manager versions 176600 and prior are vulnerable to stored cross-site scripting in the File/Directory monitor...
CVE-2025-41683
creationtimestamp| type| source ---|---|--- 2025-07-23 10:41:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lumtgvt52i2i 2025-09-09 20:56:42+00:00| seen| MISP/2bceffac-02c3-4c54-a709-6e253b38ec76...
CVE-2025-48932
creationtimestamp| type| source ---|---|--- 2025-07-23 10:13:13+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3lumruhat6b2v 2025-07-23 14:47:59+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3lunb7rep3w2d 2025-07-24 09:30:19+00:00| published-proof-of-concep...
CVE-2025-54440
creationtimestamp| type| source ---|---|--- 2025-07-23 07:31:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lumitq3uql2h 2025-07-28 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-657/...
CVE-2025-42947
creationtimestamp| type| source ---|---|--- 2025-07-23 06:58:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lumgyehibz2t 2026-08-13 08:47:29+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998...
CVE-2025-6215
creationtimestamp| type| source ---|---|--- 2025-07-23 06:30:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lumfg63wyl2w 2025-11-12 11:34:36+00:00| seen| https://threatintel.cc/2025/11/12/update-now-november-patch-tuesday.html 2025-11-12 12:34:28+00:00| seen|...
CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...