PT-2026-1398

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin versions prior to 1.6.9.6 Description The Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin for WordPress is susceptible to sensitive information exposure due to the use of a...

iccDEV 安全漏洞

iccDEV is a color configuration codebase open-sourced by the International Color Consortium ICC. A security vulnerability exists in iccDEV 2.3.1 and earlier versions, which stems from a heap buffer overflow in the CIccMBB::Validate function, which could lead to a heap buffer overflow attack...

CVE-2025-65212

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the...

iccDEV 安全漏洞

iccDEV is an open source color configuration codebase from the International Color Consortium ICC. A security vulnerability exists in iccDEV version 2.3.1.1 and earlier, which stems from a type confusion in the CIccSingleSampledeCurveXml class during the serialization of XML curves, which could...

PT-2026-1439

Name of the Vulnerable Software and Affected Versions NJHYST HY511 POE core versions prior to 2.1 NJHYST HY511 POE plugins versions prior to 0.1 Description The device exhibits insufficient cookie verification, enabling an attacker to directly request the configuration file address and download t...

iccDEV 安全漏洞

iccDEV is an open source color configuration code library from the International Color Consortium ICC. A security vulnerability exists in iccDEV version 2.3.1 and earlier, which stems from an undefined behavior in the CIccCLUT::Init function, which could lead to an undefined behavior attack...

PT-2026-1527

Name of the Vulnerable Software and Affected Versions versions prior to 2025-47332 Description A memory corruption issue exists when processing a configuration call originating from userspace. Recommendations At the moment, there is no information about a newer version that contains a fix for thi...

CVE-2025-65212

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the...

iccDEV 代码问题漏洞

iccDEV is an open source color configuration code library from the International Color Consortium ICC. A code issue vulnerability exists in iccDEV 2.3.1 and earlier versions, which stems from an integer overflow and underflow in the CIccXmlArrayType::ParseTextCountNum function, which could lead t...

Spinnaker vulnerable to SSRF due to improper restrictions on http from user input

Impact The primary impact is allowing users to fetch data from a remote URL. This data can be then injected into Spinnaker pipelines via helm or other methods to extract things LIKE idmsv1 authentication data. This ALSO includes calling INTERNAL Spinnaker API's via a get and similar endpoints...

CVE-2025-67732 Dify Vulnerable to Plaintext API Key Exposure via Model Provider Configuration Endpoint

Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services, potentially consuming limited quotas. Version...

CVE-2026-0625

CVE-2026-0625 affects multiple D-Link DSL gateway devices (e.g., DSL-2740R, DSL-2640B, DSL-2780B, DSL-526B). The dnscfg.cgi endpoint permits an unauthenticated remote command injection due to improper sanitization, enabling arbitrary shell commands execution and DNS configuration modification wit...

CVE-2026-0625 D-Link DSL/DIR/DNS Authentication Bypass via DNS Configuration Endpoint

Multiple D-Link DSL/DIR/DNS devices contain an authentication bypass and improper access control vulnerability in the dnscfg.cgi endpoint that allows an unauthenticated attacker to access DNS configuration functionality. By directly requesting this endpoint, an attacker can modify the device’s DN...

Use of Hard-coded Credentials

Overview Affected versions of this package are vulnerable to Use of Hard-coded Credentials via the interactive installer process. An attacker can gain unauthorized remote access to the host system by exploiting the default administrative credentials over SSH before the password is reset. This is...

GHSA-2HC9-CC65-XWJ8 Duplicate Advisory: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95pq-hr8p-f5g7. This link is maintained to preserve external references. Original Description An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuratio...

CVE-2025-67303

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface...

CVE-2025-14346

WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user...

GHSA-4C5F-9MJ4-M247 flagd: Multiple Go Runtime CVEs Impact Security and Availability

Summary In 2025, several vulnerabilities in the Go Standard Library were disclosed, impacting Go-based applications like flagd the evaluation engine for OpenFeature. These CVEs primarily focus on Denial of Service DoS through resource exhaustion and Race Conditions in database handling. | CVE ID ...

CVE-2025-12511

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring DSM extenstio configuration modules allows Stored XSS to user with elevated privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.1, from 24.10...

CVE-2025-12513

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Centreon Infra Monitoring Hosts configuration form modules allows Stored XSS to users with high privileges. This issue affects Infra Monitoring: from 25.10.0 before 25.10.2, from 24.10.0...