CVE-2025-41239

creationtimestamp| type| source ---|---|--- 2025-07-15 18:53:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114858762801914674 2025-07-16 12:20:29+00:00| seen| https://vulnerability.circl.lu/bundle/419fd7d2-3c77-4032-b717-747015a7b289 2025-07-16 12:26:04+00:00| seen|...

CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

CVE-2025-34112

Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 virtual appliances are affected by an authenticated multi‑stage remote code execution chain. A SQL injection in /api/common/1.0/login allows an attacker to create a new user, which is then used to trigger a command injection in /index.php?page...

CVE-2025-53891

creationtimestamp| type| source ---|---|--- 2025-07-15 06:33:43+00:00| seen| https://bsky.app/profile/potato.software/post/3ltybumgogk26...

CVE-2025-7360

CVE-2025-7360 (HT Contact Form Widget for Elementor / Gutenberg Blocks / Form Builder) The WordPress plugin versions up to 2.2.1 are vulnerable to an arbitrary file move due to insufficient file path validation in handle_files_upload(), allowing unauthenticated attackers to relocate files on the ...

CVE-2025-53027

creationtimestamp| type| source ---|---|--- 2025-07-15 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-602/...

FacialMotionID: Identifying Users of Mixed Reality Headsets Using Abstract Facial Motion Representations

Facial motion capture in mixed reality headsets enables real-time avatar animation, allowing users to convey non-verbal cues during virtual interactions. However, as facial motion data constitutes a behavioral biometric, its use raises novel privacy concerns. With mixed reality systems becoming...

CVE-2025-53825 Dokploy's Preview Deployments are vulnerable to Remote Code Execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This...

CVE-2025-53014

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processi...

CVE-2025-24391

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023....

CVE-2024-58258

creationtimestamp| type| source ---|---|--- 2025-07-14 08:13:13+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltvwxkubqw2i 2025-07-14 09:30:15+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/544 2025-07-14 10:09:32+00:00| seen|...

CVE-2025-7582 PHPGurukul Online Fire Reporting System assigned-requests.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/assigned-requests.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-25180 GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kern...

MINI-QG9W-36PV-GPPF

Bulletin has no description...

CVE-2025-02297

creationtimestamp| type| source ---|---|--- 2025-07-12 13:05:42+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3ltrgepbkdk2f...

CVE-2025-7425

creationtimestamp| type| source ---|---|--- 2025-07-11 19:10:57+00:00| seen| https://seclists.org/oss-sec/2025/q3/33 2025-07-14 10:22:52+00:00| seen| https://bsky.app/profile/buherator.bsky.social/post/3ltw67fyiun2p 2025-08-02 12:56:19+00:00| seen|...

CVE-2025-30402

creationtimestamp| type| source ---|---|--- 2025-07-11 19:03:10+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114836150017822027...

CVE-2025-5992

A denial of service flaw has been discovered in the Qt library. A call to QColorTransferGenericFunction may cause a crash if passed a maliciously crafted ICC profile. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2025-45582

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file,...

CVE-2025-38296

In the Linux kernel, the following vulnerability has been resolved: ACPI: platformprofile: Avoid initializing on non-ACPI platforms The platform profile driver is loaded even on platforms that do not have ACPI enabled. The initialization of the sysfs entries was recently moved from...