23602 matches found
CVE-2025-50348
creationtimestamp| type| source ---|---|--- 2025-06-23 18:50:39+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19245 2025-06-23 20:09:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lscf6xd55325...
CVE-2025-49126
Visionatrix is affected by a Reflected XSS in versions 1.5.0–2.5.0 (fixed in 2.5.1) via the "/docs/flows" endpoint. The root cause is the use of FastAPI’s get_swagger_ui_html without encoding or sanitizing user-controlled arguments, which is used to render the swagger docs. The vulnerability enab...
CVE-2025-52968
creationtimestamp| type| source ---|---|--- 2025-06-23 16:35:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsbza7bn4h2s...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
CVE-2025-52877
creationtimestamp| type| source ---|---|--- 2025-06-23 14:45:31+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19209 2025-06-23 16:55:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsc2dywpdv2r...
CVE-2025-48700
creationtimestamp| type| source ---|---|--- 2025-06-23 14:45:26+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19204 2025-06-23 16:11:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsbxv257qz2r 2026-04-20 20:00:03+00:00| exploited|...
CVE-2025-2172
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames...
CVE-2025-52920
Innoshop through 0.4.1 allows Insecure Direct Object Reference IDOR at multiple places within the frontend shop. Anyone can create a customer account and easily exploit these. Successful exploitation results in disclosure of the PII of other customers and the deletion of their reviews of products...
CVE-2025-52921
creationtimestamp| type| source ---|---|--- 2025-06-23 12:01:46+00:00| published-proof-of-concept| Telegram/HXBqyCxgvMHLtEfnDSGBXVUAF1NVCNReOpP5SUo5lvs4FM4 2025-06-23 12:47:50+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19197 2025-06-23 15:19:12+00:00| seen|...
CVE-2022-49988
REJECTED CVE In the Linux kernel, the following vulnerability has been resolved: binderalloc: add missing mmaplock calls when using the VMA...
CVE-2025-52935
The CVE-2025-52935 entry concerns an Integer Overflow or Wraparound vulnerability in dragonflydb/dragonfly, specifically in the src/redis/lua/struct modules (lua_struct.C). Affected versions are dragonfly 1.28.18 through 1.30.1. The issue is confirmed across multiple sources (e.g., PT-2025-26585)...
CVE-2025-29646
An issue in upf in open5gs 2.7.2 and earlier allows a remote attacker to cause a Denial of Service via a crafted PFCP SessionEstablishmentRequest packet with restoration indication = true and teid = 0 or teid = ogspfcppdrteidpool.size...
CVE-2025-50010
Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zapier for WordPress: from n/a through = 1.5.2...
CVE-2025-49132
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it...
CVE-2025-6302
A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232B20210713. Affected is the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Comment leads to stack-based buffer overflow. It is possible to launch the attack...
CVE-2025-49175
creationtimestamp| type| source ---|---|--- 2025-06-23 06:45:55+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19185 2025-07-25 14:06:31+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3lus7tfng4s2f 2026-06-30 01:30:56+00:00| seen|...
CVE-2025-52926
In scan.rs in spytrap-adb before 0.3.5, matches for known stalkerware are not rendered in the interactive user interface...
CVE-2025-52967
MLflow prior to 3.1.0 is affected by a gateway_proxy_handler issue that lacks gateway_path validation, enabling potential SSRF via gateway routes. The CVE-2025-52967 description specifies a missing validation in gateway_proxy_handler, with CVSSv3.1 vector indicating network attack, low complexity...
CVE-2025-52968
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...