CVE-2025-49186

CVE-2025-49186 describes insufficient measures to prevent multiple failed authentication attempts, enabling brute-force attempts. Connected sources tie this to vulnerabilities in SICK Enterprise Analytics and SICK Logistic Analytics products (PSIRT), noting potential impacts to confidentiality an...

CVE-2025-0673

creationtimestamp| type| source ---|---|--- 2025-06-12 11:34:10+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18161 2025-06-12 12:30:51+00:00| published-proof-of-concept| Telegram/e3hS1rnWGJylm-Uihe1IrC5pfQfLzDaPzmWNW0FRI9kftQ 2025-06-12 13:03:41+00:00| seen|...

Zero-Click AI Vulnerability Exposes Microsoft 365 Copilot Data Without User Interaction

A novel attack technique named EchoLeak has been characterized as a "zero-click" artificial intelligence AI vulnerability that allows bad actors to exfiltrate sensitive data from Microsoft 365 M365 Copilot's context sans any user interaction. The critical-rated vulnerability has been assigned the...

CVE-2025-1478

CVE-2025-1478 affects GitLab CE/EE. The issue is a lack of input validation in Board Names, which can be exploited to trigger a denial of service. Affected versions are: 8.13–17.10.6, 17.11–17.11.2, and 18.0–18.0.0. Remediation (fixed in): GitLab 17.10.7+, 17.11.3+, and 18.0.1+. No exploitation d...

CVE-2025-4278

CVE-2025-4278 affects GitLab CE/EE, with all versions starting from 18.0 up to, but not including, 18.0.2. The issue is an HTML injection vulnerability in the new search page that under certain conditions could lead to an account takeover. The available connected documents consistently describe t...

CVE-2025-21758

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05 2025-12-03 14:14:49+00:00| seen| https://vulnerability.circl.lu/bundle/816dcc8e-f25a-4895-9b59-1bbd9caeccb8 2026-07-28 16:17:10+00:00| seen|...

CVE-2025-3116

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller...

CVE-2025-40592

CVE-2025-40592 describes a zip path traversal in the Mendix Studio Pro module installation process. The vulnerability affects Mendix Studio Pro versions prior to: 8.18.35, 9.24.35, 10.6.24, 10.12.17, 10.18.7, and 10.23.0, with all versions of 11 affected. By crafting a malicious module (e.g., via...

CVE-2025-6021

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. Mitigation Mitigation for this issue is either not...

CVE-2025-49822

creationtimestamp| type| source ---|---|--- 2025-06-12 06:12:24+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrfbc3wlwn2k...

CVE-2025-35978

Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be...

CVE-2025-49817

creationtimestamp| type| source ---|---|--- 2025-06-12 05:50:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrfa3qqukl2e...

CVE-2025-49819

creationtimestamp| type| source ---|---|--- 2025-06-12 05:47:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrf7wepavb2u...

CVE-2025-4973 Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'

The Workreap plugin for WordPress, used by the Workreap - Freelance Marketplace WordPress Theme, is vulnerable to authentication bypass in all versions up to, and including, 3.3.1. This is due to the plugin not properly verifying a user's identity prior to logging them in when verifying an accoun...

CVE-2025-4387

The Abandoned Cart Pro for WooCommerce plugin contains an authenticated arbitrary file upload vulnerability due to missing file type validation in the wcapaddtocartpopupuploadfiles function in all versions up to, and including, 9.16.0. This makes it possible for an authenticated attacker, with...

CVE-2025-44043

Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery SSRF in /KeyotiSearchEngineWebCommon/SearchService.svc/GetResults and /KeyotiSearchEngineWebCommon/SearchService.svc/GetLocationAndContentCategories. An attacker can specify their own SMB server as the indexDirectory...

CVE-2024-44906

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...

CVE-2024-55567

CVE-2024-55567 affects InsydeH2O kernel (Insyde USB core) with a flaw in UsbCoreDxe that allows an SMM-level write of arbitrary memory due to improper input validation. Affected versions include InsydeH2O kernel 5.4 before 05.47.01, 5.5 before 05.55.01, 5.6 before 05.62.01, and 5.7 before 05.71.0...

CVE-2024-44906

uptrace pgdriver v1.2.1 was discovered to contain a SQL injection vulnerability via the appendArg function in /pgdriver/format.go. The maintainer has stated that the issue is fixed in v1.2.15...

CVE-2025-49146

A connection handling flaw was found in the pgjdbc connection driver in configurations that require channel binding. Connections created with authentication methods that should not allow channel binding permit connections to use channel binding. This flaw allows attackers to position themselves i...