Adobe Experience Manager Cross-Site Script Vulnerability

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A securit...

Google Chrome < 137.0.7151.103 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 137.0.7151.103. It is, therefore, affected by multiple vulnerabilities as referenced in the 202506stable-channel-update-for-desktop10 advisory. - Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a...

Salesforce OmniStudio security vulnerabilities

Salesforce OmniStudio is a digitization platform from US-based Salesforce, Inc. A security vulnerability exists in Salesforce OmniStudio versions prior to 2025 that stems from an improper privilege retention issue that could lead to field-level security control bypass...

AZL-63818 CVE-2025-5917 affecting package cmake for versions less than 3.21.4-20

A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to...

CVE-2025-41444

Zohocorp ManageEngine ADAudit Plus versions 8510 and prior are vulnerable to authenticated SQL injection in the alerts module...

FreeBSD : ModSecurity -- possible DoS vulnerability (fa1d42c8-42fe-11f0-a9fa-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the fa1d42c8-42fe-11f0-a9fa-b42e991fc52e advisory. [email protected] reports: ModSecurity is an open source, cross platform web application...

PT-2025-27290

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the version containing the fix for this issue Description: The issue is related to the Linux kernel's handling of huge page tables during VMA split. The problem arises because the split vma function triggers...

CVE-2025-48934 Deno.env.toObject() ignores the variables listed in --deny-env and returns all environment variables

Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to versions 2.1.13 and 2.2.13, the Deno.env.toObject method ignores any variables listed in the --deny-env option of the deno run command. When looking at the documentation of the --deny-env option this might lead to a false...

CVE-2025-48941

MyBB is free and open source forum software. Prior to version 1.8.39, the search component does not validate permissions correctly, which allows attackers to determine the existence of hidden draft, unapproved, or soft-deleted threads containing specified text in the title. The visibility state...

FreshRSS cross-site scripting vulnerabilities

FreshRSS is a free, self-hosted RSS aggregator from the FreshRSS open source. A cross-site scripting vulnerability exists in versions of FreshRSS prior to 1.26.2 that stems from improper cleanup of the iframe srcdoc attribute, which could lead to cross-site scripting attacks...

DEBIAN-CVE-2025-5419

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

MaxKB security vulnerability

MaxKB is a 1Panel-dev open source open source knowledge base question and answer system based on a large language model and RAG. A security vulnerability exists in versions prior to MaxKB 1.10.8-lts, which stems from a sandbox that restricts execution permissions to binary files in common...

Microsoft Edge (Chromium) < 137.0.3296.62 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 137.0.3296.62. It is, therefore, affected by multiple vulnerabilities as referenced in the June 3, 2025 advisory. - Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker t...

CVE-2025-48995 SignXML's signature verification with HMAC is vulnerable to a timing attack

SignXML is an implementation of the W3C XML Signature standard in Python. When verifying signatures with X509 certificate validation turned off and HMAC shared secret set signxml.XMLVerifier.verifyrequirex509=False, hmackey=..., versions of SignXML prior to 4.0.4 are vulnerable to a potential...

CVE-2025-45387

osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php...

Google Chrome < 137.0.7151.68 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 137.0.7151.68. It is, therefore, affected by multiple vulnerabilities as referenced in the 202506stable-channel-update-for-desktop advisory. - Use after free in Blink in Google Chrome prior to 137.0.7151.68 allowed a...

PT-2025-23469 · WordPress · Wp-Optimize

Name of the Vulnerable Software and Affected Versions: WP-Optimize versions prior to 4.2.0 Description: The issue arises from improper escaping of user input when checking image compression statuses. This could allow users with the administrator role to conduct SQL Injection attacks, particularly...

CVE-2025-48955: Insertion of Sensitive Information into Log File

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

Roundcube Webmail RCE Vulnerability (Jun 2025) - Windows

Roundcube Webmail is prone to an authenticated remote code execution RCE vulnerability via php object deserialization. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2025-48885

application-urlshortener create shortened URLs for XWiki pages. Versions prior to 1.2.4 are vulnerable to users with view access being able to create arbitrary pages. Any user even guests can create these docs, even if they don't exist already. This can enable guest users to denature the structur...