CVE-2025-26086

creationtimestamp| type| source ---|---|--- 2025-05-17 04:43:07+00:00| seen| https://schleuss.online/users/vulnbot/statuses/114521341008289755 2025-05-18 18:08:07+00:00| seen| https://bsky.app/profile/hacker.at.thenote.app/post/3lphnmuxh722c...

CVE-2025-48187

CVE-2025-48187 affects RAGFlow up to version 0.18.1. The root cause is brute-force attacks on six-digit email verification codes without rate limiting, enabling account takeover via arbitrary registration, login, or password reset. Multiple connected sources confirm the issue and its impact. Prac...

CVE-2025-4802

Untrusted LDLIBRARYPATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen including internal dlopen calls after setlocale or calls to NSS functions...

CVE-2025-4787

creationtimestamp| type| source ---|---|--- 2025-05-16 19:07:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcpzdu5vh2p...

CVE-2025-32307

creationtimestamp| type| source ---|---|--- 2025-05-16 18:37:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcodnu5vm24...

CVE-2025-31637

creationtimestamp| type| source ---|---|--- 2025-05-16 18:37:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpcodn4l6r2r...

CVE-2025-48127 WordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in App Cheap Push notification for Mobile and Web app push-notification-mobile-and-web-app allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push notification for Mobile and Web app: from n/a through = 2.0.3...

CVE-2025-4478

A flaw was found in the FreeRDP used by Anaconda's remote install feature, where a crafted RDP packet could trigger a segmentation fault. This issue causes the service to crash and remain defunct, resulting in a denial of service. It occurs pre-boot and is likely due to a NULL pointer dereference...

CVE-2025-32962 Flask-AppBuilder open redirect vulnerability using HTTP host injection

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirect by manipulating the Host header in HTTP requests. Flask-AppBuilder 4.6.2 introduced the FABSAFEREDIRECTHOSTS...

CVE-2025-40629 Path Traversal vulnerability in PNETLab

PNETLab 4.2.10 does not properly sanitize user inputs in its file access mechanisms. This allows attackers to perform directory traversal by manipulating file paths in HTTP requests. Specifically, the application is vulnerable to requests that access sensitive files outside the intended directory...

CVE-2025-1531

Authentication credentials leakage vulnerability in Hitachi Ops Center Analyzer viewpoint.This issue affects Hitachi Ops Center Analyzer viewpoint: from 10.0.0-00 before 11.0.4-00...

CVE-2025-1531

creationtimestamp| type| source ---|---|--- 2025-05-16 06:34:15+00:00| seen| https://bsky.app/profile/potato.software/post/3lpbfwd2nd224 2025-05-16 06:35:16+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/16634 2025-05-16 09:03:09+00:00| seen|...

CVE-2025-3932

The Mozilla Foundation's Security Advisory describes the following issue: It is possible to craft an email that shows a tracking link as an attachment. If the user attempts to open the attachment, Thunderbird automatically accesses the link. The configuration to block remote content does not...

CVE-2025-48175

A flaw was found in libavif. This vulnerability allows heap out-of-bounds writes via processing a specially crafted AVIF image...

CVE-2025-4742

A vulnerability classified as problematic has been found in XU-YIJIE grpo-flat up to 9024b43f091e2eb9bac65802b120c0b35f9ba856. Affected is the function main of the file grpovanilla.py. The manipulation leads to deserialization. Local access is required to approach this attack. Continious delivery...

CVE-2025-20046

Use after free for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.100 may allow an unauthenticated user to potentially enable denial of service via adjacent access...

CVE-2024-6584

The 'wpajaxboostproxyig' action allows administrators to make GET requests to arbitrary URLs...

CVE-2024-10143

The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.7.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

CVE-2025-1138

CVE-2025-1138 affects IBM InfoSphere Information Server 11.7. An Information Disclosure vulnerability allows an authenticated user to obtain sensitive information via a directory listing, enabling potential follow-on attacks. The issue is addressed in IBM’s Security Bulletin for CVE-2025-1138, wh...

CVE-2024-6711 Event Tickets with Ticket Scanner < 2.3.8 - Admin+ Stored XSS

The Event Tickets with Ticket Scanner WordPress plugin before 2.3.8 does not sanitise and escape some parameters, which could allow users with a role as low as admin to perform Cross-Site Scripting attacks...