CVE-2025-6098

creationtimestamp| type| source ---|---|--- 2025-06-16 01:00:49+00:00| published-proof-of-concept| Telegram/l0B5CkKBimBSyudynmcMQcODMATzVFj9ceMO-tGD96eVAY 2025-06-16 01:06:39+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114690359227017800 2025-06-16 03:17:39+00:00| seen|...

CVE-2025-6097 UTT 进取 750W Administrator Password setSysAdm formDefineManagement unverified password change

A vulnerability was found in UTT 进取 750W up to 5.0 and classified as critical. Affected by this issue is the function formDefineManagement of the file /goform/setSysAdm of the component Administrator Password Handler. The manipulation of the argument passwd1 leads to unverified password change. T...

CVE-2025-49795

A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service...

Fedora: Security Advisory (FEDORA-2025-4fc3431dab)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-49597

handcraftedinthealps goodby-csv is a highly memory efficient, flexible and extendable open-source CSV import/export library. Prior to 1.4.3, goodby-csv could be used as part of a chain of methods that is exploitable when an insecure deserialization vulnerability exists in an application. This...

CVE-2025-5964

CVE-2025-5964 affects M‑Files Server pre-25.6.14925.0, where a path traversal flaw in the API endpoint lets an authenticated user read server files. Public sources describe the vulnerable component as the API handling file access, with the root cause being traversal in requests to REST endpoints....

CVE-2025-49585

XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or programming right creates an XClass definition in XWiki requires edit right, and that same document is later edited by a user with script,...

CVE-2025-6091 H3C GR-3000AX aspForm UpdateIpv6Params buffer overflow

A vulnerability was found in H3C GR-3000AX V100R007L50. It has been classified as critical. Affected is the function UpdateWanParamsMulti/UpdateIpv6Params of the file /routing/goform/aspForm. The manipulation of the argument param leads to buffer overflow. It is possible to launch the attack...

CVE-2025-22854

Improper handling of non-200 http responses in the PingFederate Google Adapter leads to thread exhaustion under normal usage conditions...

CVE-2025-21085

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...

CVE-2025-6090

creationtimestamp| type| source ---|---|--- 2025-06-15 15:01:05+00:00| published-proof-of-concept| Telegram/TsLN5vHLIfKrKMRd5r9uUcmCPeQ2tSHQaEnOQUJbKYy86yg 2025-06-15 15:39:36+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18381 2025-06-15 16:58:09+00:00| seen|...

CVE-2025-21085 PingFederate OAuth Grant attribute duplication may use excessive memory

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...

CVE-2025-6089

creationtimestamp| type| source ---|---|--- 2025-06-15 13:36:03+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18376 2025-06-15 17:28:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrnyha2pnh2u 2026-01-30 09:01:36+00:00| seen|...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

CVE-2025-45988

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...

CVE-2025-45986

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 werediscovered to contain a command injection vulnerability via the mac parameter in the bsSetMacBlack function...

Konsole: Code execution

Background Konsole is KDE's terminal emulator. Description Konsole supports loading URLs from the scheme handlers such as telnet://URL. This can be executed regardless of whether the telnet binary is available. It would fallback to bash in that case and execute arbitrary code. Impact Clicking a...

GLSA-202506-12 : sysstat: Arbitrary Code Execution

The remote host is affected by the vulnerability described in GLSA-202506-12 sysstat: Arbitrary Code Execution A vulnerability has been discovered in sysstat. Please review the CVE identifier referenced below for details. This CVE improves on an incomplete fix for CVE-2022-39377. Tenable has...

CVE-2025-6065

creationtimestamp| type| source ---|---|--- 2025-06-14 08:34:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18372 2025-06-14 09:32:18+00:00| seen| Telegram/C3UTwynst7UtmZY1a-TGsY39b-ZaceEinE1WZTPPvZFFkCA 2025-06-14 10:55:49+00:00| seen|...

CVE-2025-5589

CVE-2025-5589 affects StreamWeasels Kick Integration for WordPress; all versions up to 1.1.3 are vulnerable to Stored XSS via the status-classic-offline-text parameter due to insufficient input sanitization and output escaping. Exploitation requires Contributor+ authenticated access; successful a...