Zimbra Collaboration - Unrestricted File Upload

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

PT-2026-40132

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio/.NET versions prior to 10.0.8 Description A tampering issue occurs when .NET Core improperly handles specially crafted files. An attacker can exploit this by sending a specially crafted file to a vulnerable system,...

PT-2026-36572

Name of the Vulnerable Software and Affected Versions Import and export users and customers plugin for WordPress versions prior to 2.0.9 Description An issue exists in the save extra user profile fields function where an incomplete blocklist fails to restrict capability meta keys for subsites in ...

CVE-2026-32647

NGINX Open Source and NGINX Plus have a vulnerability in the ngxhttpmp4module module, which might allow an attacker to trigger a buffer over-read or over-write to the NGINX worker memory resulting in its termination or possibly code execution, using a specially crafted MP4 file. This issue affect...

NULL Pointer Dereference

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

CVE-2023-4102

QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000312)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000312 advisory. An exploitable denial-of-service vulnerability exists in the Linux kernel prior to mainline 5.3. An attacker could exploit this vulnerability by triggering AP to sen...

KB5072653: Extended Security Updates (ESU) Licensing Preparation Package for Windows 10

KB5072653: Extended Security Updates ESU Licensing Preparation Package for Windows 10 Introduction The Windows 10 Extended Security Updates ESU program gives customers the option to receive security updates for PCs enrolled in the program. ESU is a paid program that provides individuals and...

CVE-2025-42706

A logic error exists in the Falcon sensor for Windows that could allow an attacker, with the prior ability to execute code on a host, to delete arbitrary files. CrowdStrike released a security fix for this issue in Falcon sensor for Windows versions 7.24 and above and all Long Term Visibility LTV...

EUVD-2025-27782

Malicious code in bioql PyPI...

EUVD-2025-27262

Malicious code in bioql PyPI...

EUVD-2024-28053

Malicious code in bioql PyPI...

CVE-2025-59822

CVE-2025-59822 affects http4s (Scala). Versions 1.0.0-M1 up to just before 1.0.0-M45 and before 0.23.31 are vulnerable to HTTP Request Smuggling caused by improper handling of the HTTP trailer section. The vulnerability can allow bypassing front‑end security controls, abusing active user sessions...

PT-2025-36507

Name of the Vulnerable Software and Affected Versions: Fides versions prior to 2.69.1 Description: Fides is an open-source privacy engineering platform. Admin UI user password changes do not invalidate active user sessions prior to version 2.69.1, creating a vulnerability chaining opportunity...

Exploit for CVE-2007-2447

CVE-2007-2447 Samba Exploit A Rust implementation of the CVE-...

GHSA-G4VP-4GQR-7V8C Liferay Portal Enumeration Discrepancy in Calendars

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15 and 7.4 GA through update 92 allows any authenticated remote user to view other calendars by...

May 23, 2025—KB5061906 (OS Build 20348.3695) Out-of-band

May 23, 2025—KB5061906 OS Build 20348.3695 Out-of-band For information about Windows update terminology, see types of Windows updates and the monthly quality update types. To find an overview of Windows Server 2022, see its update history page.Be sure to follow @WindowsUpdate to find out when new...

CVE-2025-20002

After attempting to upload a file that does not meet prerequisites, GMOD Apollo will respond with local path information disclosure...

CVE-2024-55955

An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged...

Security Bulletin: AIX is vulnerable to a denial of service due to ISC BIND

Summary Multiple vulnerabilities in ISC BIND could allow a remote attacker to cause a denial of service CVE-2024-0760, CVE-2024-1737, CVE-2024-4076, CVE-2024-1975. AIX uses ISC BIND as part of its DNS functions. Vulnerability Details CVEID:CVE-2024-0760 DESCRIPTION: ISC BIND is vulnerable to a...