CVE-2025-33061

Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally...

CVE-2025-47166

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2025-32725

Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

CVE-2025-47968

Improper input validation in Microsoft AutoUpdate MAU allows an authorized attacker to elevate privileges locally...

CVE-2025-47977

Improper neutralization of input during web page generation 'cross-site scripting' in Nuance Digital Engagement Platform allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-32718

Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally...

CVE-2025-32712

Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally...

CVE-2025-33068

Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network...

CVE-2025-33050

Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network...

CVE-2025-33075

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2024-43706

Improper authorization in Kibana can lead to privilege abuse via a direct HTTP request to a Synthetic monitor endpoint...

CVE-2024-44905

go-pg pg v10.13.0 was discovered to contain a SQL injection vulnerability via the component /types/appendvalue.go...

CVE-2025-4678

Improper Neutralization of Special Elements in the chromiumpath variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105...

CVE-2025-49200

CVE-2025-49200 describes unencrypted backup files that can lead to disclosure of sensitive information when a backup is downloaded and decompressed. The linked sources reference SICK Field Analytics and SICK Media Server in relation to vulnerable backups, with no explicit product version or compo...

CVE-2025-49195

CVE-2025-49195 describes a vulnerability where an FTP server login mechanism does not limit authentication attempts, enabling brute-force password guessing. Connected sources associate this issue with SICK Field Analytics and SICK Media Server products. The CVE is tracked in NVD/Red Hat/CVE recor...

CVE-2025-49186

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks...

CVE-2025-49186

CVE-2025-49186 describes insufficient measures to prevent multiple failed authentication attempts, enabling brute-force attempts. Connected sources tie this to vulnerabilities in SICK Enterprise Analytics and SICK Logistic Analytics products (PSIRT), noting potential impacts to confidentiality an...

CVE-2025-0673

creationtimestamp| type| source ---|---|--- 2025-06-12 11:34:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18161 2025-06-12 12:30:51+00:00| published-proof-of-concept| Telegram/e3hS1rnWGJylm-Uihe1IrC5pfQfLzDaPzmWNW0FRI9kftQ 2025-06-12 13:03:41+00:00| seen|...

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence AI vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 M365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the...

CVE-2025-1478

CVE-2025-1478 affects GitLab CE/EE. The issue is a lack of input validation in Board Names, which can be exploited to trigger a denial of service. Affected versions are: 8.13–17.10.6, 17.11–17.11.2, and 18.0–18.0.0. Remediation (fixed in): GitLab 17.10.7+, 17.11.3+, and 18.0.1+. No exploitation d...