CVE-2025-52887 cpp-httplib has unlimited number of http header fields, which causes memory leak

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected...

CVE-2025-6707

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior ...

CVE-2025-6677

creationtimestamp| type| source ---|---|--- 2025-06-26 13:50:57+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19595 2025-06-26 18:29:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsjqzpbnul2i...

CVE-2025-6624

creationtimestamp| type| source ---|---|--- 2025-06-26 10:35:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsiwk3lf3n2r 2025-06-26 13:51:05+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19602...

CVE-2025-6212

creationtimestamp| type| source ---|---|--- 2025-06-26 09:50:42+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19583 2025-06-26 12:34:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsj56eibgv2r...

CVE-2025-5459

A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0...

CVE-2025-6290

creationtimestamp| type| source ---|---|--- 2025-06-26 02:50:38+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19556 2025-06-26 06:24:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsiiiamt2w2v...

CVE-2025-5929

CVE-2025-5929 – The Countdown WordPress plugin is reported to have a Stored Cross-Site Scripting vulnerability via the clientId parameter in versions up to and including 2.0.1. The vulnerability requires authentication at Contributor level or higher, and could allow an attacker to inject scripts ...

CVE-2024-11584

cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable. This is used for the "/run/cloud-init/hook-hotplug-cmd" FIFO. An unprivileged user could trigger hotplug-hook commands...

CVE-2024-52928

Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites with previously granted permissions to add new permissions when the user clicks anywhere on the website...

CVE-2025-49550

creationtimestamp| type| source ---|---|--- 2025-06-25 17:52:47+00:00| seen| https://bsky.app/profile/potato.software/post/3lsh6ihfv5e2h 2025-06-25 18:51:53+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19511...

CVE-2025-6444

The CVE-2025-6444 entry covers a vulnerability in ServiceStack where the GetErrorResponse method in ServiceStack.Text improperly validates user-supplied data, enabling NTLM credential relay. The flaw derives from a type confusion condition caused by insufficient input validation, allowing a remot...

CVE-2025-52890

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options security.macfiltering, security.ipv4filtering and security.ipv6filtering. This can lead to ARP...

CVE-2025-49152

The affected products contain JSON Web Tokens JWT that do not expire, which could allow an attacker to gain access to the system...

CVE-2025-49153

The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code...

CVE-2025-52889

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services DHCP, DNS... that partially bypass security options security.macfiltering, security.ipv4filtering and...

CVE-2025-6442 Ruby WEBrick read_header HTTP Request Smuggling Vulnerability

Ruby WEBrick readheader HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected installations of Ruby WEBrick. This issue is exploitable when the product is deployed behind an HTTP proxy that fulfills specific conditions. The...

CVE-2025-6616

creationtimestamp| type| source ---|---|--- 2025-06-25 16:47:34+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19479 2025-06-30 20:26:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114774193882630947...

CVE-2025-52569 GitHub.jl lacks validation for user-provided fields

GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided values in certain functions. In the GitHub.repo function, the user can provide any string for the reponame field. These inputs are not validate...

CVE-2025-6435

If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the .download file extension. This could have led to the user inadvertently running a malicious executable. This vulnerability affects Firefox 140 and...