CVE-2025-5335

creationtimestamp| type| source ---|---|--- 2025-06-10 15:53:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114659874146155178 2025-06-12 04:34:36+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18145...

CVE-2025-5353

creationtimestamp| type| source ---|---|--- 2025-06-10 15:51:18+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114659863942584780 2025-06-10 16:01:27+00:00| published-proof-of-concept| Telegram/Cx1-p36APBve2ZXOx6JZQ1ihep0qwdXJnQmLSJI9jXODK8 2025-06-11 04:33:14+00:00| seen|...

CVE-2025-49143 Nautobot may allows uploaded media files to be accessible without authentication

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIAROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint...

CVE-2025-49143

Summary: CVE-2025-49143 affects Nautobot before v2.4.10 and v1.6.32. The issue is improper access control on files stored in Nautobot’s MEDIA_ROOT, including DeviceType images and other attachments, which could be retrieved by anonymous users via guessed URLs. Affected versions: Nautobot 2.x vers...

CVE-2025-48937 matrix-sdk-crypto vulnerable to sender of encrypted events being spoofed by homeserver administrator

matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly validate the sender of an encrypted event. Accordingly, a malicious homeserver operator can modify events served to clients, making those event...

CVE-2025-32716

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review...

CVE-2025-33063

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review...

CVE-2025-33069

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 23:33:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18026 2025-07-09 14:24:50+00:00| seen|...

CVE-2025-33071

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 19:18:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbmcabj6v2k 2025-06-11 04:33:25+00:00| seen|...

CVE-2025-47956

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-07-11 16:36:47+00:00| seen| https://bsky.app/profile/cti-news.bsky.social/post/3ltpbpc5ec62m 2025-07-15 17:21:04+00:00| seen|...

CVE-2025-47953

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 20:11:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrbpb66vlm2q 2025-06-14 01:06:08+00:00| seen|...

CVE-2025-33060

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review...

CVE-2025-47167

creationtimestamp| type| source ---|---|--- 2025-06-10 15:24:53+00:00| seen| https://www.thezdi.com/blog/2025/6/10/the-june-2025-security-update-review 2025-06-10 17:32:51+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17953 2025-06-10 20:06:46+00:00| seen|...

CVE-2025-48067

OctoPrint (web interface for controlling consumer 3D printers) contains a vulnerability in versions up to and including 1.11.1 where an attacker with FILE_UPLOAD permission can exfiltrate host files that OctoPrint can read by moving them into the upload folder, from which they can be downloaded. ...

CVE-2024-29198

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery SSRF via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the...

CVE-2025-30145 GeoServer has an Infinite Loop Vulnerability in Jiffle process

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This...

CVE-2025-49510 WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross Site Request Forgery.This issue affects Min Max Step Quantity Limits Manager for WooCommerce: from n/a through = 5.1.0...

CVE-2025-27242

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through improper input...

CVE-2025-41657

creationtimestamp| type| source ---|---|--- 2025-06-10 10:52:34+00:00| seen| https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3lrapystmstn2 2025-06-10 11:34:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17872...

CVE-2025-40658

An Insecure Direct Object Reference IDOR vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area setting the option parameter equal to 0, 1 or 2 in /administer/selectionnode/framesSelection.asp...