CVE-2025-46406

CVE-2025-46406 describes a Privilege Context Switching Error (CWE-270) in Gallagher Command Centre Server. A privileged Operator with high-level access in one Division could perform limited privileged activities across the Division boundary, potentially enabling cross-division elevation of privil...

CVE-2025-44003

CVE-2025-44003 affects Gallagher T-Series Reader. A CWE-772 resource leak in the reader allows a limited denial of service when 125 kHz Card Technology is enabled, exploitable by someone with physical access. Affected versions include: prior to 9.20.250213a, prior to 9.10.250213a, prior to 9.00.2...

Schneider Electric EcoStruxure IT Data Center Expert Root Password Discovery

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-6311: Insufficient Entropy CVE ID: CVE-2025-50122 2. Vulnerability Description The Data Center Expert "DCE"...

CVE-2025-30313 Illustrator | Out-of-bounds Read (CWE-125)

Illustrator versions 28.7.6, 29.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-49533 Adobe Experience Manager (MS) | Deserialization of Untrusted Data (CWE-502)

Adobe Experience Manager MS versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction. Scope is unchanged...

CVE-2025-47135 Dimension | Out-of-bounds Read (CWE-125)

Dimension versions 4.1.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must...

Session still active for deleted admin

...

DNS type 65 resource record requests bypass DNS filter

...

PKI via API: Authentication granted with an invalid certificate

...

IBM MQ 9.3 < 9.4.3 CD / 9.4 < 9.4.0.12 LTS / 9.4.3 (7238310)

The version of IBM MQ Server running on the remote host is affected by a vulnerability as referenced in the 7238310 advisory. - An IBM MQ Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. CWE: CWE-416: Use After Free CVE-2025-3631 Note th...

WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Skalucy in WordPress Plugin WPShapere - WordPress admin theme versions = 1.4.1...

RAS-Eval: a Comprehensive Benchmark for Security Evaluation of LLM Agents in Real-World Environments

The rapid deployment of Large language model LLM agents in critical domains like healthcare and finance necessitates robust security frameworks. To address the absence of standardized evaluation benchmarks for these agents in dynamic environments, we introduce RAS-Eval, a comprehensive security...

PT-2025-26162

Name of the Vulnerable Software and Affected Versions EfroTech Time Trax version 1.0 Description An issue in EfroTech Time Trax allows a remote attacker to execute arbitrary code via the file attachment function in the leave request form. This is related to the CWE-434 Unrestricted Upload of File...

No CWE? No Excuse. Why Classification Gaps Are a Hacker’s Dream

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! In cybersecurity, we obsess over...

CVE-2025-3112

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause Denial of Service when an authenticated malicious user sends manipulated HTTPS Content-Length header to the webserver...

CVE-2025-3898

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends HTTPS request containing invalid data type to the webserver...

CVE-2025-3899

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists in Certificates page on Webserver that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

CVE-2025-3117

CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists impacting configuration file paths that could cause an unvalidated data injected by authenticated malicious user leading to modify or read data in a victim’s browser...

CVE-2025-3116

CWE-20: Improper Input Validation vulnerability exists that could cause Denial of Service when an authenticated malicious user sends special malformed HTTPS request containing improper formatted body data to the controller...

CVE-2025-5741

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause arbitrary file reads from the charging station. The exploitation of this vulnerability does require an authenticated session of the web server...