CVE-2025-6138

The CVE-2025-6138 entry applies to TOTOLINK T10 (version 4.1.8cu.5207). The vulnerability is in the HTTP POST Request Handler function setWizardCfg, in the file /cgi-bin/cstecgi.cgi, where manipulation of the ssid5g argument causes a buffer overflow. It can be exploited remotely, and the exploit ...

CVE-2025-6128

creationtimestamp| type| source ---|---|--- 2025-06-16 15:39:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18462 2025-06-16 16:27:20+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114693979502813612 2025-06-16 16:33:45+00:00| published-proof-of-concept|...

CVE-2025-4565

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashin...

CVE-2025-48988

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. The following versions were EOL at the time the CVE was created but are known to be...

CVE-2025-40916

creationtimestamp| type| source ---|---|--- 2025-06-16 11:39:57+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18441 2025-06-16 14:32:50+00:00| published-proof-of-concept| Telegram/U8pKzxPaqTMvqzadPo8O1KrDHB3eplOCTxi2a-1fsFdgwBo 2025-06-16 15:08:12+00:00| seen|...

CVE-2025-24388

OTRS Administrative and Agent Interfaces are affected by CVE-2025-24388. A parameter injection vulnerability exists for an authenticated admin or agent user in versions before OTRS 8, impacting OTRS 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X and ((OTRS)) Community Edition 6.0.x. The issue stems from pa...

CVE-2025-4748

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2,...

CVE-2025-40728

SQL injection vulnerability in Customer Support System v1.0. This vulnerability allows an authenticated attacker to retrieve, create, update and delete databases via the id parameter in the /customersupport/manageuser.php endpoint...

CVE-2025-49709 vulnerabilities

Vulnerabilities for packages: firefox...

CVE-2025-6109

creationtimestamp| type| source ---|---|--- 2025-06-16 06:36:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18418 2025-06-16 07:48:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrpikccokq2u 2025-06-16 10:09:38+00:00| seen|...

CVE-2025-6101

CVE-2025-6101 affects the letta-ai letta project up to version 0.4.1. The vulnerable component is the function_message logic in the file letta/letta/interface.py, where manipulation of the arguments function_name/function_args enables improper neutralization of directives in dynamically evaluated...

CVE-2025-6097

creationtimestamp| type| source ---|---|--- 2025-06-16 00:38:43+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18390 2025-06-16 01:33:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrotla7zzv2k...

CVE-2025-5964

creationtimestamp| type| source ---|---|--- 2025-06-15 20:39:24+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18386 2025-06-15 21:00:28+00:00| seen| Telegram/qqGdRq3IEZWlesNnwy1ijPtikCMQVd1aEhfCMytKb8KLZk 2025-06-15 21:06:26+00:00| seen|...

CVE-2025-5990

creationtimestamp| type| source ---|---|--- 2025-06-15 19:01:17+00:00| published-proof-of-concept| Telegram/cdlz3y5IHmZBzdfZM02iXdk0I82b8uC2wbv6lTKq0J7SQ 2025-06-15 21:23:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lroflspgz32i 2025-06-16 14:38:17+00:00|...

CGA-M992-3CX9-H6GX

Bulletin has no description...

CVE-2025-6092

creationtimestamp| type| source ---|---|--- 2025-06-15 17:36:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18383 2025-06-15 21:28:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrofur5ojm2r...

CVE-2024-25573

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing...

CVE-2025-21085

PingFederate CVE-2025-21085 describes a grant attribute duplication issue in the PostgreSQL persistence store that can cause excessive memory utilization for OAuth2 requests. The affected product is PingFederate; the root cause is duplication in the OAuth2 grant storage within PostgreSQL, leading...

CVE-2025-21085 PingFederate OAuth Grant attribute duplication may use excessive memory

PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...

CVE-2025-4584

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...