PT-2025-51691

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to a race condition within the dwc3 remove requests function. This occurs due to unsynchronized execution of multiple call paths, potentially...

Cisco IMC vKVM Redirection

The vulnerability of the Virtual Keyboard Video Monitor vKVM system, a remote administration tool from Cisco’s Integrated Management Controller IMC, involves redirecting URLs to an unreliable website. Exploiting this vulnerability allows a malicious actor to redirect users to any given URL addres...

Linux Keyboard Driver Heap Buffer Overflow DoS

The vulnerability in the drivers/input/keyboard/croseckeyb.c file of the keyboard driver for the ChromeOS embedded controller EC in the Linux operating system is related to incorrect initialization of resources. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2025-14722

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722 vion707 DMadmin Backend AddonsController.class.php add cross site scripting

A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed...

CVE-2025-14722

CVE-2025-14722 affects vion707 DMadmin (Backend) with a Cross-Site Scripting vulnerability in the Add function of Admin/Controller/AddonsController.class.php. A remote attacker can manipulate input to trigger XSS; exploits have been publicly disclosed. Affected versions are prior to 3403cafdb4253...

CVE-2025-13281

A half-blind Server-Side Request Forgery SSRF found in kube-controller-manager that can be triggered when using the legacy in-tree Portworx StorageClass. An authorized user with sufficient privileges can cause the controller to make requests to internal, host-network–accessible endpoints,...

CVE-2025-13824

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:GHSA-8M3C-C723-H4P...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65430 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65430 Source advisory: OSV:GHSA-QHMC-3MVR-F2J...

openwisp-controller (>=0.2.0, <=0.3.1), openwisp-network-topology (>=0.1.0a0, <=0.2.2) +2 more potentially affected by CVE-2025-65431 via django-allauth (0.38.0)

django-allauth PYPI version 0.38.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - openwisp-controller =0.2.0, =0.1.0a0, =0.1.11, =0.1.0a0, =0.1.0 Source cves: CVE-2025-65431 Source advisory: OSV:PYSEC-2025-111...

EUVD-2025-203310

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

GHSA-R6J8-C6R2-37RR kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

CVE-2025-14711: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This vulnerability affects unknown code of the file /controller/api/hotelList.php. This manipulation of the argument pickedHotelName/type causes sql injection. The attack is possible to be carried...

CVE-2025-14710: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in FantasticLBP Hotels Server up to 67b44df162fab26df209bd5d5d542875fcbec1d0. This affects an unknown part of the file /controller/api/OrderList.php. The manipulation of the argument telephone results in sql injection. The attack can be executed remotely. The exploit ...

PT-2025-54719

A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...

PT-2025-51312

Name of the Vulnerable Software and Affected Versions vion707 DMadmin versions prior to 3403cafdb42537a648c30bf8cbc8148ec60437d1 Description A cross-site scripting issue exists in vion707 DMadmin. The issue is located in the Add function of the Admin/Controller/AddonsController.class.php file...

Rockwell Automation’s various products have security vulnerabilities

The Rockwell Automation Micro820, among others, is a programmable controller from Rockwell Automation USA. A security vulnerability in several Rockwell Automation products, which stems from improper handling of malformed packets by the IPv6 stack, could cause the controller to enter a recoverable...