R9 platform Authentication Data Unencrypted DoS

The vulnerability of the R9 platform for building automation systems lies in the storage of authentication data in unencrypted configuration files. Exploiting this vulnerability could allow a perpetrator to gain unauthorized access to the system...

CVE-2025-52655: Inclusion of Functionality from Untrusted Control Sphere

Inclusion of Functionality from Untrusted Control Sphere vulnerability in HCL MyXalytics. v6.6 allows Loading third-party scripts without integrity checks or validation can allow external code run in the application's context, risking data exposure...

PT-2025-41545

Name of the Vulnerable Software and Affected Versions HCL AION version 2.0 Description A security issue has been identified in HCL AION where cached data may expose credentials, system identifiers, or internal file paths to attackers with access to the device or browser. Recommendations At the...

WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Legion Hunter in WordPress Plugin AppExperts versions = 1.4.5...

Fedora 41 : wordpress (2025-acd3e11344)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-acd3e11344 advisory. WordPress 6.8.3 Release Security updates included in this release: A data exposure issue where authenticated users could access some restricted content...

PT-2025-41410

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R3 Description A flaw exists in the web interface of Junos Space that could allow a network-based attacker with valid credentials to download arbitrary files from the file system. An attacker...

ABB eSOMS Authorization Bypass

The vulnerability of the ABB eSOMS software for managing production processes is related to improper authorization. Exploiting this vulnerability can allow a remote attacker to gain access to protected information...

TOTOLINK downloadFile.cgi RCE

The vulnerability of the downloadFile.cgi script in the microprogramming software for TOTOLINK A830R, TOTOLINK A950RG, TOTOLINK A3000RU, and TOTOLINK A3100R is related to buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity...

Fedora 42 : wordpress (2025-0fe3b1b7fc)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0fe3b1b7fc advisory. WordPress 6.8.3 Release Security updates included in this release: A data exposure issue where authenticated users could access some restricted content...

CVE-2025-27236

A regular Zabbix user can search other users in their user group via Zabbix API by select fields the user does not have access to view. This allows data-mining some field values the user does not have access to...

USN-7812-1 imagemagick vulnerabilities

Woojin Park, Hojun Lee, Yougin Won and Siyeon Han discovered that ImageMagick did not properly sanitize image file names. An attacker could possibly use this issue to cause a denial of service, obtain sensitive information, or execute arbitrary code. CVE-2025-55298 Lumina Mescuwa discovered that...

ABB LVS MConfig

SUMMARY ABB became aware of an internally discovered vulnerability in the MConfig product versions listed as affected in the advisory. An attacker with access to local networks who successfully exploits vulnerability could have access to application’s sensitive information. ABB strongly advises...

CVE-2025-61999

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected content is executed in the context of other users when they view affected pages. Successful exploitation allows the administrative user to perfo...

CVE-2025-61998

OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager. Injected content is executed in the context of other users when they click the malicious link. Successful exploitation allows the...

PT-2025-41239

Name of the Vulnerable Software and Affected Versions JhumanJ OpnForm versions up to 1.9.3 Description A weakness exists in JhumanJ OpnForm, potentially leading to information exposure. The issue stems from a discrepancy within the Forgotten Password Handler component, specifically related to the...

NVIDIA Megatron-LM msdp() Code Execution

The vulnerability of the msdp function in the training library for large language models like NVIDIA Megatron-LM exists due to improper code generation control. Exploiting this vulnerability allows attackers to execute arbitrary code, gain elevated privileges, and expose sensitive information...

CVE-2025-43909

Dell PowerProtect Data Domain (DD OS) versions 7.7.1.0–8.3.0.15, LTS2025 8.3.1.0, LTS2024 7.13.1.0–7.13.1.30, and LTS2023 7.10.1.0–7.10.1.60 contain a vulnerability in the DD boost component due to use of a broken or risky cryptographic algorithm. An unauthenticated, remote attacker could exploit...

CVE-2025-61777

Flag Forge is a Capture The Flag CTF platform. Starting in version 2.0.0 and prior to version 2.3.2, the /api/admin/badge-templates GET and /api/admin/badge-templates/create POST endpoints previously allowed access without authentication or authorization. This could have enabled unauthorized user...

CVE-2025-40885

A SQL Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized da...

CVE-2025-40887

A SQL Injection vulnerability was discovered in the Alert functionality due to improper validation of an input parameter. An authenticated user with limited privileges can execute arbitrary SELECT SQL statements on the DBMS used by the web application, potentially exposing unauthorized data...