45308 matches found
Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components
CVE-2025-55182 also referred to as React2Shell and includes CVE-2025-66478, which was merged into it is a critical pre-authentication remote code execution RCE vulnerability affecting React Server Components, Next.js, and related frameworks. With a CVSS score of 10.0, this vulnerability could all...
CVE-2025-64434 affecting package kubevirt for versions less than 1.5.3-2
CVE-2025-64434 affecting package kubevirt for versions less than 1.5.3-2. An upgraded version of the package is available that resolves this issue...
Critical React2Shell Vulnerability (CVE-2025-55182) Analysis: Surge in Attacks Targeting RSC-Enabled Services Worldwide
Torrance, United States / California, December 12th, 2025, CyberNewsWire In December 2025, CVE-2025-55182 React2Shell, a vulnerability in React…...
CVE-2025-65779
Wekan up to version 18.15 is affected; fixed in 18.16. An unauthenticated attacker can update a board's sort value because Boards.allow returns true without verifying userId, enabling arbitrary reordering of boards. Affected: Wekan (Open Source Kanban board) prior to 18.16. Impact: potential alte...
Arbitrary File Upload
open-webui is vulnerable to Arbitrary File Upload. The vulnerability is due to insufficient validation of uploaded file content types and user-controlled filenames, which allows an attacker to overwrite critical files and potentially execute arbitrary code...
Improper Authorization
getgrav/grav is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks when modifying critical form fields via POST requests, which allows an attacker to alter YAML frontmatter including form processing logic and potentially exploit unintended actions...
CVE-2025-54369 Node-SAML SAML Authentication Bypass
Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the unsigned original response document. This is different than the parts that are verified when checking signature. This allows an attacker to modify...
CVE-2025-54369
Node-SAML vulnerable in versions 5.0.1 and earlier because it loads the assertion from the unsigned original response document, which differs from the parts verified during signature validation. This allows an attacker to modify authentication details within a valid SAML assertion (e.g., removing...
Exploit for CVE-2025-66516
CVE-2025-66516: Critical XXE Vulnerability in Apache Tika...
PT-2025-50907
Name of the Vulnerable Software and Affected Versions PenciDesign Soledad versions n/a through 8.6.9 Description A flaw exists in PenciDesign Soledad that allows for privilege escalation. This allows subscribers to take over WordPress sites. Recommendations Update PenciDesign Soledad to a version...
Slackware: Security Advisory (SSA:2025-345-01)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass
MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dynamic linker and other critical files, potentially resulting in privilege escalation. This issue is fixed in version 2.4.0...
CVE-2025-13780
pgAdmin versions up to 9.10 are affected by a Remote Code Execution RCE vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical...
CVE-2025-13780 Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)
pgAdmin versions up to 9.10 are affected by a Remote Code Execution RCE vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical...
Exploit for CVE-2024-7954
Exploitation of Remote Code Execution Vulnerability CVE-2024-...
Cybersecurity Performance Goals 2.0 for Critical Infrastructure
Today, CISA released updated Cross-Sector Cybersecurity Performance Goals CPG 2.0 with measurable actions for critical infrastructure owners and operators to achieve a foundational level of cybersecurity. This update incorporates lessons learned, aligns with the most recent National Institute of...
EulerOS 2.0 SP13 : libwebsockets (EulerOS-SA-2025-2504)
According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability, which was classified as critical, was found in warmcat libwebsockets up to 4.3.6/4.4.2. This affects the function...
LLM-Assisted AHP for Explainable Cyber Range Evaluation
Cyber Ranges CRs have emerged as prominent platforms for cybersecurity training and education, especially for Critical Infrastructure CI sectors that face rising cyber threats. One way to address these threats is through hands-on exercises that bridge IT and OT domains to improve defensive...
Ukrainian Woman in US Custody for Aiding Russian NoName057 Hacker Group
Ukrainian national Victoria Dubranova is in U.S. custody, accused of supporting Russian hacker group NoName057 in cyberattacks on critical infrastructure. She has pleaded not guilty...