CVE-2025-55316: External Control of File Name or Path

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-10046

The CVE-2025-10046 issue affects the WordPress plugin ELEX WooCommerce Google Shopping (Google Product Feed) up to version 1.4.3. The vulnerability resides in includes/elex-manage-feed-ajax.php where the file_to_delete parameter is not properly sanitized and the SQL query is not prepared, allowin...

CVE-2025-58361

CVE-2025-58361 : Promptcraft Forge Studio contains an incomplete URL scheme check in its validation.ts that does not block XSS via SVG/data URLs. User-controlled URLs pass through the check and, if used in href/src, can allow script execution. Affected: Promptcraft Forge Studio (all versions) wit...

CVE-2025-7405: Missing Authentication for Critical Function

Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not...

Exploit for CVE-2025-55349

CVE-2025-55349 — pm2 Arbitrary Code Execution via postinstall...

Linux Distros Unpatched Vulnerability : CVE-2025-30719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.1.6. Easily exploitable...

CVE-2025-30260: Allocation of Resources Without Limits or Throttling

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from accessing the same type of resource. We hav...

Linux Distros Unpatched Vulnerability : CVE-2022-21627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 6.1.40. Easily...

Use of Externally-Controlled Format String

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Linux Distros Unpatched Vulnerability : CVE-2010-2198

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deleti...

CVE-2025-7839: Cross-Site Request Forgery (CSRF)

The Restore Permanently delete Post or Page Data plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the rpdpodpaajaxdpdeletedata function. This makes it possible for unauthenticated...

Linux Distros Unpatched Vulnerability : CVE-2023-2253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the /v2/catalog endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned query...

TencentOS Server 4: mysql (TSSA-2025:0613)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0613 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Autodesk AutoCAD DGN File Parsing Uninitialized Variable Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Autodesk AutoCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DG...

CVE-2011-10030

Foxit PDF Reader 4.3.1.0218 exposes a JavaScript API function, createDataObject, that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code...

CVE-2011-10030 Foxit PDF Reader < 4.3.1.0218 JavaScript File Write

Foxit PDF Reader 4.3.1.0218 exposes a JavaScript API function, createDataObject, that allows untrusted PDF content to write arbitrary files anywhere on disk. By embedding a malicious PDF that calls this API, an attacker can drop executables or scripts into privileged folders, leading to code...

CVE-2024-39954 Apache EventMesh Runtime: SSRF

CWE-918 Server-Side Request Forgery SSRF in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version 1.12.0 or use the master branch , which...

CVE-2025-4437: Allocation of Resources Without Limits or Throttling

There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent user, CRI-O attempts to create the user, reading the container's entire /etc/passwd file into memory. If this file is excessively large, it can cause the a hi...

Linux Distros Unpatched Vulnerability : CVE-2020-28327

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A respjsipsession crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. and Certifi...

ROS-20250819-06

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...