CVE-2026-53549

An authenticated low-privileged user can exploit the unvalidated POST /host/db/proxy/test endpoint to probe internal hosts, metadata services, and cloud credentials; fixed in Termix 2.3.2. No exploitation evidence provided in the documents.

WordPress Gutenverse Form plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Gutenverse Form versions = 2.3.1...

CVE-2025-61588 risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sysread, the host is able to use a crafted response to write to an arbitrary memory location in th...

CVE-2025-54999

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

PT-2025-32381

Name of the Vulnerable Software and Affected Versions OpenBao versions 0.1.0 through 2.3.1 Description OpenBao is a software solution designed for managing, storing, and distributing sensitive data, including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, user enumeration was...