CVE-2025-57916

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Nurul Amin WP System Information wp-system-info allows Retrieve Embedded Sensitive Data.This issue affects WP System Information: from n/a through = 1.5...

CVE-2025-57437

The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977. When connected, the service reveals extensive device configuration data including: - Model, version, and unique identifiers - Network settings including IP, MAC,...

CVE-2025-57433

The CVE-2025-57433 entry concerns the 2wcom IP-4c device (version 2.15.5). A vulnerability in the web interface allows information disclosure via a crafted POST to /cwi/ajax_request/get_data.php. An authenticated user, even with low privileges (e.g., guest), can retrieve hashed passwords for admi...

CVE-2025-34202 Vasion Print (formerly PrinterLogic) Insecure Access to Docker Instances WAN

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 VA and SaaS deployments expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a...

CVE-2025-59040

CVE-2025-59040 concerns Tuleap. Backlog item representations do not verify the permissions of child trackers, potentially allowing users to see tracker names they should not access due to unverified sub-tracker privileges. Affected products: Tuleap Community Edition and Tuleap Enterprise Edition....

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2025:03233-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03233-1 advisory. - CVE-2024-3019: exposure of the redis server backend allows remote command execution via pmproxy bsc1222121. Tenable has extracted the...

PT-2025-38152

Name of the Vulnerable Software and Affected Versions Jenkins versions 2.527 and earlier Jenkins LTS versions 2.516.2 and earlier Description Jenkins does not perform a permission check for the authenticated user profile dropdown menu. This allows attackers without Overall/Read permission to obta...

CVE-2025-34183 Ilevia EVE X1 Server 4.7.18.0.eden Credentials Leak Through Log Disclosure

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

CVE-2025-34183

Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retrieve plaintext credentials from exposed .log files. This flaw enables full authentication bypass and system compromise through credential...

MAL-2025-47397 Malicious code in capacitor-plugin-vonage (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d89f3813eea824f42ffe8eba246c1abb9f4857b3a7cb55155a7941b9631b49b Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47373 Malicious code in @art-ws/config-ts (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e845947405bf6a59280848d6a325827b53bdca23c8a3b28e4db032075842cccb Any computer that has this package installed or running should be considered fully compromised. All...

UBUNTU-CVE-2025-4953

A flaw was found in Podman. In a Containerfile or Podman, data written to RUN --mount=type=bind mounts during the podman build is not discarded. This issue can lead to files created within the container appearing in the temporary build context directory on the host, leaving the created files...

Malicious code in ember-velcro (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb2c22cbb7ab559c0ac1e61418ae224e561beacb9571166240b4c5249a098dbb Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-27238

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them...

CVE-2025-55243

Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-58752

A path traversal / static-file serving bypass vulnerability has been identified in Vite’s static file server, where HTML files located outside the configured root or deny/allow lists may be served even when server.fs settings such as deny are used. An attacker can exploit this by requesting HTML...

Plex users: Reset your password!

Media streaming platform Plex has warned customers about a data breach, advising them to reset their password. Plex said an attacker broke into one of its databases, allowing them to access a "limited subset" of customer data. This included email addresses, usernames, hashed passwords, and...

PT-2025-37079

Name of the Vulnerable Software and Affected Versions: Intelbras IWR 3000N version 1.9.8 Description: The Intelbras IWR 3000N version 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. An unauthenticated user on the local network can obtain the Wi-Fi network password by...

Linux Distros Unpatched Vulnerability : CVE-2020-7905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ports listened to by JetBrains IntelliJ IDEA before 2019.3 were exposed to the network. CVE-2020-7905 Note that Nessus relies on the presence of the package as...

CVE-2025-55976

Intelbras IWR 3000N 1.9.8 exposes the Wi-Fi password in plaintext via the /api/wireless endpoint. Any unauthenticated user on the local network can directly obtain the Wi-Fi network password by querying this endpoint...