EUVD-2025-210514

Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...

CVE-2025-59177

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

EUVD-2025-210513

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

CVE-2025-59177

CVE-2025-59177 affects Ericsson’s Packet Core Controller (PCC) prior to version 1.39. The issue stems from a vulnerability in the Configuration Management subsystem that allows an attacker to execute specially crafted commands to cause error messages to reveal a system secret. The description exp...

CVE-2025-59177 Generation of Error Message Containing Sensitive Information Vulnerability

Ericsson Packet Core Controller PCC versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages...

Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server and are addressed in the latest release and ifix Vulnerability Details CVEID:CVE-2025-62718 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not...

CVE-2025-15662 Printcart Web to Print Product Designer for WooCommerce < 2.5.3 - Unauthenticated Arbitrary File Read and Server-Side Request Forgery

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files including configuration...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

Buffalo WSR-2533DHPL2 - Path Traversal

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. id: CVE-2021-20090 info: name: Buffalo WSR-2533DHPL2 - Path...

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

Linux Distros Unpatched Vulnerability : CVE-2026-64538

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check...

Xerox AltaLink Missing Authorization (CVE-2021-28669)

Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights. This plugin only works with Tenable.ot. Please visit...

PT-2026-64999

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description A remote code execution issue exists in the configuration API. Authenticated administrators possessing CONFIGURATION EDIT and ATTACHMENT ADD privileges can write arbitrary PHP files by manipulating...

[SECURITY] Fedora 43 Update: p11-kit-0.26.4-1.fc43

p11-kit provides a way to load and enumerate PKCS11 modules, as well as a standard configuration setup for installing PKCS11 modules in such a way that they're discoverable...

CVE-2026-66012 SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-64347

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: composite: fix dead empty check in the USBDTOTG handler The OTG branch of compositesetup falls back to the first configuration when none is selected: if cdev-config config = cdev-config; else config =...

CVE-2026-64512

In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Suppress UBSAN warning caused by field misuse The definition of reg-accesswidth changes depending on the reg-spaceid type. Type ACPIADRSPACEPLATFORMCOMM uses accesswidth to indicate the PCC region, which can result in...

CVE-2026-64510

In the Linux kernel, the following vulnerability has been resolved: ACPI: NFIT: core: Fix acpinfitinit error cleanup If acpinfitinit fails after adding the acpidesc object to the acpidescs list, that object is never removed from that list because the acpinfitshutdown devm action is not added for...

EUVD-2026-49019

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64307

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...