GHSA-F7QG-XJ45-W956 Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark

Impact A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8. Patches v5.130.4 and v6.0.9 contain a fix for this issue. Referenc...

CVE-2025-8557

An internal product security audit of Lenovo XClarity Orchestrator LXCO discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator LXCO network segment may be able to manipulate the local device to create an alternate communication channel...

CVE-2025-54376

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...

CVE-2025-8557

CVE-2025-8557 concerns Lenovo XClarity Orchestrator (LXCO). An attacker with access to a device on the local LXCO network segment can manipulate that device to create an alternate communication channel, enabling direct interaction with backend LXCO API services that are normally inaccessible to u...

Lenovo XClarity Orchestrator 安全漏洞

Lenovo XClarity Orchestrator is an application from the Chinese company Lenovo Lenovo. It provides centralized monitoring, management, and analysis for environments containing a large number of devices. A security vulnerability exists in Lenovo XClarity Orchestrator that originates in a local...

CVE-2025-54376

Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...

CVE-2025-7426

Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environments where this FTP server is part of...

CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection

Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...

CVE-2025-7813

CVE-2025-7813 refers to the Eventin plugin for WordPress (The Events Calendar, Event Booking, Registrations and Event Tickets) where SSRF exists in all versions up to 4.0.37 via the proxy_image function. The vulnerability allows unauthenticated attackers to make web requests from the application ...

CVE-2025-33100

IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...

CVE-2025-33100

CVE-2025-33100 concerns IBM Concert Software versions 1.0.0–1.1.0 that allegedly contain hard-coded credentials used for inbound authentication, outbound communication, or data encryption. The core issue is a trust/credential hard-coding flaw, which could enable unauthorized access or leakage of ...

CVE-2025-48861

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps...

PT-2025-33139 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability exists in the Task API endpoint of the ctrlX OS setup mechanism. This allows a remote, unauthenticated attacker to access and extract internal application data, including...

CVE-2025-25229

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery SSRF Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources...

CVE-2025-25229

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery SSRF Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources...

CVE-2025-25229

Omnissa Workspace ONE UEM is affected by a Server-Side Request Forgery (SSRF) vulnerability (CVE-2025-25229). The issue could allow a user with privileges to access restricted internal information and enumerate internal network resources via API endpoints. The connected documents corroborate the ...

CVE-2025-25229

Omnissa Workspace ONE UEM contains a Server-Side Request Forgery SSRF Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources...

Linux Distros Unpatched Vulnerability : CVE-2021-3501

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by ...

WordPress plugin Broken Link Notifier 代码问题漏洞

WordPress Broken Link Notifier plugin is a plugin for monitoring broken links e.g. 404 errors, timeout links, etc. within a website. The WordPress Broken Link Notifier plugin suffers from a code issue vulnerability that stems from the server not implementing an adequate validation mechanism to...

CVE-2024-23825

TablePress is a table plugin for Wordpress. For importing tables, TablePress makes external HTTP requests based on a URL that is provided by the user. That user input is filtered insufficiently, which makes it is possible to send requests to unintended network locations and receive responses. On...