MetInfo CMS 安全漏洞

MetInfo CMS is a content management system from China's Mito MetInfo. A security vulnerability exists in MetInfo CMS version 8.0, which stems from insufficient validation and cleanup of SVG file uploads and could lead to a stored cross-site scripting attack...

Zyxel < 5.38 Directory Traversal

According to its banner, the version of Zyxel running on the remote host is 5.38. It is, therefore, affected by a Directory Traversal that could allow an attacker to download or upload files via a crafted URL. Note that the scanner has not tested for these issues but has instead relied only on th...

PT-2025-40483

Name of the Vulnerable Software and Affected Versions Flexi plugin for WordPress versions up to and including 4.28 Description The Flexi plugin for WordPress is susceptible to Stored Cross-Site Scripting through the flexi-form-tag shortcode. Insufficient input sanitization and output escaping on...

PT-2025-40543

Name of the Vulnerable Software and Affected Versions Video Station versions prior to 5.8.4 Description An SQL injection issue exists in Video Station. A remote attacker who has obtained a user account can potentially execute unauthorized code or commands. Recommendations Update to Video Station...

QNAP Video Station SQL注入漏洞

QNAP Video Station is a multimedia application from Taiwan, China-based QNAP Technology QNAP. A SQL injection vulnerability exists in QNAP Video Station versions prior to 5.8.4. The vulnerability stems from insufficient validation of input and could lead to a SQL injection attack...

WordPress plugin Wp cycle text announcement SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injection...

AlmaLinux 8 : idm:DL1 (ALSA-2025:17129)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:17129 advisory. FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA CVE-2025-7493 Tenable has extracted the preceding description block directly from the...

SUSE CVE-2025-59150

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed i...

CVE-2025-59952

MinIO Java SDK is a Simple Storage Service aka S3 client to perform bucket and object operations to any Amazon S3 compatible object storage service. In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically...

CVE-2025-61691

VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product...

CVE-2025-58777

VT Studio versions 8.53 and prior contain an access of uninitialized pointer vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product...

CVE-2025-61692

VT STUDIO versions 8.53 and prior contain a use after free vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product...

CVE-2025-61692

CVE-2025-61692 affects KEYENCE VT STUDIO (versions 8.53 and earlier). The issue is a use-after-free vulnerability in VT STUDIO, allowing arbitrary code execution if a specially crafted file is opened or processed by the affected product. Public sources consistently identify the vulnerable compone...

KEYENCE VT STUDIO 资源管理错误漏洞

KEYENCE VT STUDIO is a human-machine interface screen design and configuration software from KEYENCE Japan. A resource management error vulnerability exists in KEYENCE VT STUDIO version 8.53 and earlier, which originates from a reuse after release and could lead to the execution of arbitrary code...

PT-2025-40429

Name of the Vulnerable Software and Affected Versions Traccar versions 5.8 through 6.0 Traccar versions 6.1 through 6.8.1 Description Traccar, an open source GPS tracking system, has a flaw that allows for unauthenticated local file inclusion attacks. This can result in the disclosure of password...

SUSE CVE-2022-50437

In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork:...

GHSA-9MH6-G99M-PPCW auth0-PHP SDK Does Not Properly Handle File Types in Bulk User Import

Overview In applications built with the Auth0-PHP SDK, the Bulk User Import endpoint does not validate the file path wrapper or value. Without proper validation, affected applications may accept arbitrary file paths or URLs. Am I affected? You are affected by this vulnerability if you meet the...

CVE-2025-59150

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed i...

CVE-2025-59150 Suricata: Keyword tls.subjectaltname can lead to NULL-ptr deref

Suricata is a network IDS, IPS and NSM engine developed by the OISF Open Information Security Foundation and the Suricata community. Version 8.0.0's usage of the tls.subjectaltname keyword can lead to a segmentation fault when the decoded subjectaltname contains a NULL byte. This issue is fixed i...

CVE-2025-59150

CVE-2025-59150 affects Suricata 8.0.0, where using the tls.subjectaltname keyword can cause a segmentation fault if the decoded subjectaltname contains a NULL byte. The issue is fixed in 8.0.1; a workaround is to disable rules using the tls.subjectaltname keyword. The NVD/NASL/Nessus entries corr...