CVE-2025-58488

Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information. User interaction is required for triggering this vulnerability...

Eclipse Paho Go MQTT v3.1 library 安全漏洞

Eclipse Paho Go MQTT v3.1 library is a Go language software library from the Eclipse Foundation. A security vulnerability exists in Eclipse Paho Go MQTT v3.1 library version 1.5.0 and prior versions, which originates from an overflow during unchecked data-length conversion and could lead to the...

PT-2025-48600

Name of the Vulnerable Software and Affected Versions MotionPhoto versions prior to 4.1.51 Description An improper access control issue exists in the MPLocalService component of MotionPhoto. This allows local attackers to initiate a privileged service. Recommendations Update MotionPhoto to versio...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the password feature that could allow a local attacker to bypass authentication via a physical access device...

CVE-2025-66403 FileRise Vulnerable to Stored XSS via SVG Upload

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting XSS vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG...

CVE-2025-66303

Grav vulnerability CVE-2025-66303: In Grav prior to 1.8.0-beta.27, the admin panel can enter malformed cron-like input in the scheduled_at parameter, e.g., a single quote, causing DoS by corrupting backup.yaml. The issue stems from insufficient sanitization of cron expressions. Recovery requires ...

CVE-2025-66385

UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges e.g., obtain a higher role such as admin via the user-edit endpoint by supplying or modifying roleid or organisationid fields in the edit request...

Apache bRPC 安全漏洞

Apache bRPC is the United States Apache Apache Foundation's industrial-grade RPC framework for building reliable and high-performance services. Apache bRPC suffers from a denial of service vulnerability due to an uncontrolled recursion flaw in the json2pb component. An attacker could exploit the...

EUVD-2025-199830

Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9...

CVE-2025-13765

Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9...

CVE-2025-64720

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in pngimagereadcomposite when processing palette images with PNGFLAGOPTIMIZEALP...

UBUNTU-CVE-2025-59820

In KDE Krita before 5.2.13, loading a manipulated TGA file could result in a heap-based buffer overflow in plugins/impex/tga/kistgaimport.cpp aka KisTgaImport. Control flow proceeds even when a number of pixels becomes negative...

KDE Applications 安全漏洞

KDE Applications is an open source software suite from the KDE community that provides over 200 applications that run on any Linux desktop as well as other platforms. A security vulnerability exists in KDE Applications versions prior to 25.08.0, which stems from the use of QIODevice::ReadWrite ma...

SwitchBot Smart Video Doorbell 安全漏洞

SwitchBot Smart Video Doorbell is a smart video doorbell from SwitchBot USA. A security vulnerability exists in SwitchBot Smart Video Doorbell versions prior to 2.01.078, which stems from the presence of active debugging code that could allow an attacker to access the device via Telnet...

CVE-2025-59820

CVE-2025-59820 affects KDE Krita prior to 5.2.13, where loading a manipulated TGA file can trigger a heap-based buffer overflow in KisTgaImport (plugins/impex/tga/kis_tga_import.cpp). Debian/Alpine advisories confirm this can lead to potential arbitrary code execution; fixed packages are provided...

EUVD-2025-199665

pypdf is a free and open-source pure-python PDF library. Prior to version 6.4.0, an attacker who uses this vulnerability can craft a PDF which leads to a memory usage of up to 1 GB per stream. This requires parsing the content stream of a page using the LZWDecode filter. This issue has been patch...

CVE-2025-66017 CGGMP21 presignatures can be used in the way that significantly reduces security

CGGMP24 is a state-of-art ECDSA TSS protocol that supports 1-round signing requires 3 preprocessing rounds, identifiable abort, and a key refresh protocol. In versions 0.6.3 and prior of cggmp21 and version 0.7.0-alpha.1 of cggmp24, presignatures can be used in the way that significantly reduces...

CVE-2025-59485

CVE-2025-59485 affects Security Point (Windows) of MaLion prior to Ver.5.3.4. The flaw allows placing an arbitrary file in a specific folder by a logged-in user; if the file is a crafted DLL, it could execute code with SYSTEM privileges. Remediation: update to Security Point MaLion Ver.5.3.4 or l...

AZL-70928 CVE-2025-64720 affecting package libpng for versions less than 1.6.51-1

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in pngimagereadcomposite when processing palette images with PNGFLAGOPTIMIZEALP...

Ilevia EVE X1 Server 安全漏洞

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A security vulnerability exists in Ilevia EVE X1 Server v4.7.18.0.eden and prior versions, which stems from a cross-site request forgery in the bhwebbackend component and could lead to arbitrary code execution...