CVE-2025-21584

...

CVE-2025-21582

...

CVE-2025-21581

CVE-2025-21581 affects Oracle MySQL Server (component: Server: Optimizer). Affected versions are 8.0.0–8.0.41, 8.4.0–8.4.4, and 9.0.0–9.2.0. The vulnerability is exploitable over the network with high privileges and can cause a hang or a frequently repeating crash (complete DoS) of MySQL Server. ...

CVE-2025-21579

...

CVE-2025-21578

CVE-2025-21578 affects Oracle Secure Backup (General component). Affects Oracle Secure Backup versions 12.1.0.1–12.1.0.3 and 18.1.0.0–18.1.0.2. The issue allows a high-privileged attacker with logon to the infrastructure where Oracle Secure Backup runs to compromise the product, potentially leadi...

CVE-2025-21574

...

CVE-2025-21573

...

CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-31949

Growatt Cloud Applications (Growatt Cloud portal) is affected by CVE-2025-31949. An authenticated attacker can obtain arbitrary plant names by supplying a plant ID, indicating an access/validation weakness in the plant-name retrieval mechanism. Public details confirm vulnerable versions include 3...

CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-33026

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-28136

creationtimestamp| type| source ---|---|--- 2025-04-15 16:38:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujatgh4m2g 2025-04-15 17:26:32+00:00| seen| https://t.me/cvedetector/22953...

CVE-2025-24949

creationtimestamp| type| source ---|---|--- 2025-04-15 15:54:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11858 2025-04-15 18:43:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmuqak72xv2j 2025-04-15 19:57:03+00:00| seen| https://t.me/cvedetector/22965...

CVE-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

CVE-2025-31945

creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04 2025-04-15 22:44:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmv5o2sh272h 2025-04-16 01:48:53+00:00| seen| https://t.me/cvedetector/2302...

CVE-2025-32993

Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password aka index.php?/home/forgot-password visusername parameter. Authentication is not needed...

CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2024-49200

An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. Th...

CVE-2025-28136

TOTOLINK A800R (firmware V4.1.2cu.5137_B20200730) contains a buffer overflow in the downloadFile.cgi component. The issue arises from improper validation of input data length in that CGI, with impact described as a buffer overflow (CVSS-ish context indicates Network access with low attack complex...