CVE-2025-34090

A security bypass flaw was found in Google Chrome. A local low-privileged attacker can hijack the COM class identifier registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie...

CVE-2025-34092

A cookie encryption bypass flaw was found in Google Chrome. When Chrome encrypts a cookie key, it records its executable path as validation metadata. Later, when decrypting, the elevation service compares the requesting process’s path to this stored path. However, due to path canonicalization...

CVE-2025-34075

A virtual machine escape vector has been discovered in HashiCorp Vagrant. By design, Vagrant automatically mounts the host system’s project directory into the guest VM under /vagrant. This includes the Vagrantfile configuration file, which is a Ruby script evaluated by the host every time a vagra...

CVE-2025-52891

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least...

CVE-2025-24332

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

CVE-2025-24332 Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

CVE-2025-24332

Nokia Single RAN AirScale baseband prior to 23R4-SR 3.0 MP is affected. An authenticated administrative user can move laterally across baseband boards via the internal bsoc SSH over the baseband backplane, using an SSH private key on the baseband system board, without re-authentication. This effe...

CVE-2025-24332 Authenticated admin user can connect baseband internally from one board to another without needing to re-authentication

Nokia Single RAN AirScale baseband allows an authenticated administrative user access to all physical boards after performing a single login to the baseband system board. The baseband does not re-authenticate the user when they connect from the baseband system board to the baseband capacity board...

PT-2025-27658 · Unknown · Secret Server

Name of the Vulnerable Software and Affected Versions: Secret Server versions 11.7.49 and earlier Description: The distributed engine of Secret Server can be exploited during an initial authorization event, allowing an attacker to impersonate another distributed engine. Recommendations: For Secre...

PT-2025-27662 · Enensys · Enensys Ipguard

Name of the Vulnerable Software and Affected Versions: ENENSYS IPGuard v2 version 2.10.0 Description: The issue concerns hardcoded credentials in the software. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world inciden...

CVE-2025-53103

An information disclosure flaw was found in JUnit. When writing Open Test Reporting XML files, git credentials may be leaked. The full impact of this flaw depends on how these XML files are handled on a per-environment basis. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-6297

A temporary file cleanup flaw was found in dpkg. When extracting a control member into a temporary directory, the code responsible for cleaning up the temporary directory does not sanitize the directory permissions, leaving temporary files behind. Repeated and automated execution of dpkg-deb...

CVE-2024-46993

A flaw was found in Electron. The nativeImage.createFromPath and nativeImage.createFromBuffer functions contain a heap buffer overflow triggered by processing excessively large image data. This flaw allows a local attacker to trigger this overflow by providing a specially crafted image file or...

CVE-2024-46992

A flaw was found in Electron. The vulnerability stems from improper handling of ASAR Archive files, allowing a local attacker to manipulate archive contents without proper integrity verification. This issue can lead to arbitrary code execution within the application's context via a crafted ASAR...

CVE-2025-6554

A flaw was found in chromium. A type confusion vulnerability in the V8 JavaScript engine allows a remote attacker to achieve arbitrary read and write operations via a specially crafted HTML page. This allows an attacker to potentially manipulate memory contents. The exploitation vector involves t...

WordPress Houzez Theme <= 4.0.4 is vulnerable to Local File Inclusion

Software Houzez Type Theme Vulnerable versions = 4.0.4 Fixed in 4.0.8 OWASP Top 10 A3: Injection Classification Local File Inclusion CVE CVE-2025-53198 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID d9a95839ea4d Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

CVE-2025-32463

A flaw was found in Sudo. This flaw allows a local attacker to escalate their privileges by tricking Sudo into loading an arbitrary shared library using the user-specified root directory via the -R --chroot option. An attacker can run arbitrary commands as root on systems that support...

CVE-2025-6920

A flaw was found in the authentication enforcement mechanism of a model inference API in ai-inference-server. All /v1/ endpoints are expected to enforce API key validation. However, the POST /invocations endpoint failed to do so, resulting in an authentication bypass. This vulnerability allows...

CVE-2025-6858

A flaw was found in hdf5. The H5Cflushsingleentry function contains a NULL pointer dereference triggered by the manipulation of data within a file. A local attacker can induce this condition. This issue can lead to a potential denial of service. Mitigation Mitigation for this issue is either not...

CVE-2025-6857

A flaw was found in hdf5. The H5Gnodecmp3 function in src/H5Gnode.c contains a stack-based buffer overflow vulnerability that is triggered by manipulating data within a file. This flaw allows a local attacker to provide a specially crafted file. This issue can lead to a denial of service...