CVE-2016-15056 Ubee EVW3226 Unauthenticated Backup File Disclosure

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

CVE-2023-7327

Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Successful exploitation allows an unauthenticated attacker to use URL-encoded traversal sequences to read arbitrary files from the underlying filesystem with the privileges of the gateway service,...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2025-64745 via astro (>=5.2.1, <=5.15.1)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =0.5.0, =0.0.1, =0.1.0, =0.0.1, =2.18.7, =1.25.426-4, =0.6.2, =0.1.2-alpha.1, =0.0.28, =0.0.28, =0.0.40 and more Source cves: CVE-2025-64745 Source advisory: SNYK:JS-ASTRO-13961435...

CVE-2016-15055

CVE-2016-15055 affects JVC VN-T IP-camera models with firmware up to 2016-08-22 (confirmed on VN-T216VPRU). The vulnerability is a directory traversal in the /checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this to read arbitrary fi...

Arbitrary Client-Side File Disclosure

aiomysql is vulnerable to Arbitrary Client-Side File Disclosure. The vulnerability is due to the client not validating server requests for local files, and attackers can exploit this by running a rogue MySQL server that sends LOADLOCAL packets to request and retrieve arbitrary files from the clie...

PT-2025-46733

Name of the Vulnerable Software and Affected Versions Ozeki SMS Gateway versions up to and including 10.3.208 Description Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal issue. A successful exploit allows an unauthenticated attacker to read arbitrary files from th...

KB5068861: Windows 11 Version 24H2 / Windows Server 2025 / Windows 11 Version 25H2 Security Update (November 2025)

The remote Windows host is missing security update 5068861 or hotpatch 5068966. It is, therefore, affected by multiple vulnerabilities - Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally. CVE-2025-62208,...

OESA-2025-2618 python-aiomysql security update

aiomysql is a "driver" for accessing a MySQL database from the asyncio PEP-3156/tulip framework. It depends on and reuses most parts of PyMySQL . aiomysql tries to be like awesome aiopg library and preserve same api, look and feel. Security Fixes: aiomysql is a library for accessing a MySQL...

PT-2025-45144

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description An issue exists where the XML parser is improperly configured. The application processes user-provided XML data without adequate restrictions, potentially allowing the resolution of...

CVE-2025-10713: Improper Restriction of XML External Entity Reference

An XML External Entity XXE vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote,...

Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability

Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files...

OESA-2025-2616 python-aiomysql security update

aiomysql is a "driver" for accessing a MySQL database from the asyncio PEP-3156/tulip framework. It depends on and reuses most parts of PyMySQL . aiomysql tries to be like awesome aiopg library and preserve same api, look and feel. Security Fixes: aiomysql is a library for accessing a MySQL...

XML External Entity (XXE) Injection

Overview org.jenkins-ci.plugins:jdepend is a The JDepend Plugin is a plugin to generate JDepend reports for builds. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to XML parsing misconfiguration. An attacker can access sensitive information or induce...

PT-2025-44268

Name of the Vulnerable Software and Affected Versions Keras affected versions not specified Description The Keras Model.load model method is susceptible to arbitrary local file loading and Server-Side Request Forgery SSRF, even when safe mode=True is enabled. This issue arises from the handling o...

CVE-2025-12055

HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 week 36/2025, which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" paramet...

CVE-2025-12055 Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System

HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 week 36/2025, which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" paramet...

CVE-2025-12055 Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System

HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 week 36/2025, which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" paramet...

PT-2025-43887

Name of the Vulnerable Software and Affected Versions HYDRA X, MIP 2, and FEDRA 2 versions prior to Maintenance Pack 36 with Servicepack 8 week 36/2025 Description HYDRA X, MIP 2, and FEDRA 2 are affected by a local file disclosure issue. An unauthenticated attacker can read arbitrary files from...

CVE-2025-12055: Improper Limitation of a Pathname to a Restricted Directory

HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 week 36/2025, which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" paramet...

CVE-2025-61923

PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. N...