SUSE CVE-2025-0495

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...

CVE-2025-26125

An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter v12.1.0 allows attackers to arbitrarily delete files and escalate privileges...

CVE-2025-30154

reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v...

Reviewdog 安全漏洞

Reviewdog is an open source automated code review tool from Reviewdog. A security vulnerability exists in Reviewdog that stems from malicious code that could leak exposed keys...

GNET G-ONX 安全漏洞

GNET G-ONX is a series of car recorders from GNET. A security vulnerability exists in GNET G-ONX that stems from an exposed API endpoint that allows remote access to recorded and live video streams...

IROAD V Series 安全漏洞

IROAD V Series is a series of car recorders from IROAD. A security vulnerability exists in IROAD V Series, which arises from an exposed endpoint of the car recorder that allows unauthorized users to list and download recorded videos and access live video streams...

CVE-2025-30111

On IROAD v9 devices, one can Remotely Dump Video Footage and the Live Video Stream. The dashcam exposes endpoints that allow unauthorized users, who gained access through other means, to list and download recorded videos, as well as access live video streams without proper authentication...

Fortinet FortiSandbox 安全漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox suffers from a security vulnerability that stems from th...

CVE-2025-26125

IObit Malware Fighter v12.1.0 is affected by a vulnerability involving an exposed ioctl in the IMFForceDelete driver. This flaw allows unprivileged attackers to arbitrarily delete files and achieve privilege escalation . One method of escalation involves exploiting the MSI rollback mechanism by d...

PT-2025-11525

Name of the Vulnerable Software and Affected Versions IObit Malware Fighter version 12.1.0 Description An exposed ioctl in the IMFForceDelete driver of IObit Malware Fighter allows attackers to arbitrarily delete files and escalate privileges. Recommendations As a temporary workaround, consider...

CVE-2025-2080

The CVE-2025-2080 entry covers Optigo Networks Visual BACnet Capture Tool and Optigo Visual Networks Capture Tool (version 3.1.2rc11). The connected sources document two concrete issues: (1) an exposed web management service that could allow an attacker to bypass authentication and gain control o...

CVE-2025-26701

An issue was discovered in Percona PMM Server OVA before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3...

CVE-2025-23185

Vulnerability summary: SAP Business Objects Business Intelligence Platform exposes internal technical details due to improper error handling. What is affected: SAP Business Objects BI Platform (information disclosure vulnerability). Root cause: Exceptions and stack traces reveal application inter...

CVE-2024-10321

CVE-2024-10321 affects the WordPress plugin All-in-One Addons for Elementor – WidgetKit (WidgetKit for Elementor) version

KSRTC AWATAR 访问控制错误漏洞

KSRTC AWATAR is an online bus ticket booking application of Karnataka State Road Transport KSRTC Corporation, India. A security vulnerability exists in KSRTC AWATAR v1.3.0, which stems from improper access control and could lead to viewing sensitive information such as usernames and passwords...

CVE-2025-27662

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005...

Linux Distros Unpatched Vulnerability : CVE-2019-6778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In QEMU 3.0.0, tcpemu in slirp/tcpsubr.c has a heap-based buffer overflow. CVE-2019-6778 Note that Nessus relies on the presence of the package as reported by t...

Linux Distros Unpatched Vulnerability : CVE-2017-5661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. T...

CVE-2025-27498 AEADs/ascon-aead: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

aes-gcm is a pure Rust implementation of the AES-GCM. In decryptinplacedetached, the decrypted ciphertext which is the correct ciphertext is exposed even if the tag is incorrect. This is because in decryptinplace in asconcore.rs, tag verification causes an error to be returned with the plaintext...

K000150185: TCP/IP protocol vulnerabilities CVE-2024-7595, CVE-2024-7596, CVE-2025-23018, and CVE-2025-23019

Security Advisory Description CVE-2024-7595 GRE and GRE6 Protocols RFC2784 do not validate or verify the source of a network packet allowing an attacker to spoof and route arbitrary traffic via an exposed network interface that can lead to spoofing, access control bypass, and other unexpected...