20286 matches found
Exploit for CVE-2025-25014
CVE-2025-25014 – Critical Remote Code Execution in Kibana vi...
CVE-2025-54121
A denial of service flaw was found in the Starlette ASGI framework. This flaw allows a remote attacker to submit a specially crafted multi-part form with large files. This can exhaust the server's resources, which may block the main thread pool and lead to a denial of service. Mitigation Mitigati...
CVE-2025-30192
A denial of service flaw haws been discovered in powerdns. An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a higher chance of success than non-ECS enabled queries. Mitigation Mitigation for this issue is either not available or the currently available options do...
CVE-2025-50151
A file path validation flaw has been discovered in Apache Jena. This flaw allows users with administrative access to upload arbitrary configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...
CVE-2025-49656
Users with administrator access can create databases files outside the files area of the Fuseki server. This issue affects Apache Jena version up to 5.4.0. Users are recommended to upgrade to version 5.5.0, which fixes the issue. Mitigation Mitigation for this issue is either not available or the...
CVE-2025-30192
CVE-2025-30192 affects PowerDNS Recursor: an attacker spoofing answers to ECS-enabled queries can succeed more easily than for non-ECS queries. The updated release/file notes describe mitigations that harden spoofing resistance by chaining ECS-enabled requests and enforcing stricter validation of...
WordPress Post SMTP plugin <= 3.2.0 - Account Takeover Vulnerability
Account Takeover Vulnerability discovered by Denver Jackson Patchstack Alliance in WordPress Plugin Post SMTP versions = 3.2.0...
CVE-2025-54352
A flaw was found in WordPress, which allows remote attackers to enumerate private and draft post titles by sending pingback requests via XML-RPC. This information disclosure occurs because the system does not adequately protect these post titles from external access. An attacker can achieve this...
CVE-2025-54314
A flaw was found in Thor, where it improperly constructs shell commands using data derived from libraries. This flaw allows a local attacker to execute arbitrary commands. Command execution occurs when processing specially crafted library input. Mitigation Mitigation for this issue is either not...
CVE-2025-47917
A flaw was found in mbedtls. The mbedtlsx509stringtonames function incorrectly documents a head argument as an output, leading to a use-after-free vulnerability when applications follow the provided documentation. This vulnerability allows a network-based attacker to trigger this condition,...
CVE-2025-48965
A flaw was found in mbedtls. The mbedtlsasn1storenameddata function experiences a NULL pointer dereference when val.p is NULL while val.len is greater than zero, leading to a potential crash. This flaw allows a network-based attacker to trigger this condition, resulting in a denial of service...
Exploit for Deserialization of Untrusted Data in Microsoft
ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect an...
Alchemy Non-SMA and Webauthn Account Security Advisory
A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted...
PT-2025-31716 · Npm · @Account-Kit/Smart-Contracts
Impact A potential security issue has been mitigated on old account deployment functions from the factory. Smart wallets in use on all existing supported networks are not impacted. Patches Please direct creation of new wallets to either createSemiModularAccount on AccountFactory.sol or...
EUVD-2025-22538
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this...
CVE-2025-54310
A local file access flaw has been discovered in qBittorrent. This flaw may allow access to local files when a web page should be expected. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising...
CVE-2025-7783
A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated b...
CVE-2025-53901
Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.4, 33.0.2, and 34.0.2, a bug in Wasmtime's implementation of the WASIp1 set of import functions can lead to a WebAssembly guest inducing a panic in the host embedder. The specific bug is triggered by calling pathopen after calling...
CVE-2025-23267
A flaw was found in nvidia-container-toolkit. The update-ldcache hook contains a vulnerability allowing an attacker to trigger link following via a specially crafted container image. This issue allows a local attacker to potentially cause data corruption. The root cause is the improper handling o...