CVE-2025-29192

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

CVE-2025-61198

A stored cross-site scripting XSS vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payloa...

CubeAPM security vulnerabilities

CubeAPM is a code development tool from CubeAPM, Inc. A security vulnerability exists in the CubeAPM nightly-2025-08-01-1 release that originates from an unauthenticated attacker being able to inject arbitrary log entries via the /api/logs/insert/elasticsearch/bulk endpoint, which could lead to l...

EUVD-2025-32882

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986500)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986500 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-414384)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-414384 advisory. A vulnerability, which was classified as problematic, has been found in Linux Kernel. This issue affects the function nilfsattachlogwriter of the file...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-386953)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-386953 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series nilfs2: fix log writer...

WordPress plugin WP Reset has a log information leakage vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A log...

CVE-2025-11462: Improper Link Resolution Before File Access

Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a...

Amazon AWS VPN Client security vulnerabilities

Amazon AWS VPN Client is a fully managed remote access VPN solution from Amazon.com, Inc. A security vulnerability exists in Amazon AWS VPN Client versions 1.3.2 through 5.2.0, which stems from insufficient validation of the log target directory during log rotation, and could lead to elevation of...

CVE-2025-44823

Nagios Log Server (before 2024R1.3.2) is vulnerable: unauthenticated? No—authenticated users with access to the API can call /nagioslogserver/index.php/api/system/get_users to retrieve cleartext admin API keys. The underlying issue exposes user accounts and API keys, enabling full system compromi...

CVE-2025-44824

Nagios Log Server prior to 2024R1.3.2 is affected by CVE-2025-44824. An authenticated user with read-only API access can call /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch to stop Elasticsearch. The API reportedly returns could not stop elasticsearch, yet the service stops, e...

CVE-2025-57564

The CubeAPM platform, specifically version nightly-2025-08-01-1 , is vulnerable to an unauthenticated log injection flaw. The issue stems from the /api/logs/insert/elasticsearch/_bulk endpoint, which fails to perform input validation or require authentication when accepting bulk log data. Remote ...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

Nagios Log Server security vulnerabilities

Nagios Log Server is a suite of centralized log management, monitoring, and analysis software from Nagios, Inc. A security vulnerability exists in Nagios Log Server versions prior to 2024R1.3.2, which originates from an authenticated user being able to stop the Elasticsearch service via an API...

CVE-2025-44824: Incorrect Authorization

Nagios Log Server before 2024R1.3.2 allows authenticated users with read-only API access to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsystem=elasticsearch call. The service stops even though "message": "Could not stop elasticsearch" is in the API response...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-395439)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-395439 advisory. In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211...

PT-2025-41169

Name of the Vulnerable Software and Affected Versions AWS VPN Client for macOS versions 1.3.2 through 5.2.0 Description A flaw exists in the AWS VPN Client for macOS that allows a local user to execute code with elevated privileges. Insufficient validation of the log destination directory during...

EUVD-2025-32855

CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform...

CVE-2025-57564: Improper Output Neutralization for Logs

CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/bulk endpoint. This endpoint accepts bulk log data without requiring authentication or input validation, allowing remote attackers to perform...