CGA-PRX6-JQF9-J3W5

Bulletin has no description...

PT-2025-26805 · Git +1 · Xmlsec

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software is susceptible to a heap-buffer-overflow write issue. The crash state involves the functions xmlParsePubidLiteral, xmlParseExternalID, and xmlParseNotationDecl. Recommendations...

Brotli decompression bomb DoS

This report is not public...

CVE-2025-5337

creationtimestamp| type| source ---|---|--- 2025-06-14 09:35:13+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18375 2025-06-14 13:25:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrl2h65l7s2o...

CVE-2025-50148

creationtimestamp| type| source ---|---|--- 2025-06-14 07:21:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrkg2v7mwt2p...

OSV-2025-457 Heap-buffer-overflow in xmlParsePubidLiteral

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=424242614 Crash type: Heap-buffer-overflow WRITE 1 Crash state: xmlParsePubidLiteral xmlParseExternalID xmlParseEntityDecl...

PT-2025-26667 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software is susceptible to a heap-buffer-overflow write issue. The crash occurs during the execution of the xmlParsePubidLiteral, xmlParseExternalID, and xmlParseEntityDecl functions...

PT-2025-26668 · Git +1 · Xmlsec

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software contains a heap-buffer-overflow vulnerability. The crash state indicates the issue occurs within the xmlParsePubidLiteral, xmlParseExternalID, and xmlParseDocTypeDecl functions...

CVE-2025-24919

creationtimestamp| type| source ---|---|--- 2025-06-13 22:37:28+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18347 2025-06-13 23:14:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrjkueqdv52r 2025-08-06 13:05:54+00:00| seen|...

CVE-2025-48914

creationtimestamp| type| source ---|---|--- 2025-06-13 16:37:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18316 2025-06-13 17:31:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrixouteeg2k 2025-06-13 20:02:32+00:00| seen|...

CVE-2025-49580

creationtimestamp| type| source ---|---|--- 2025-06-13 16:37:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18312 2025-06-13 17:05:18+00:00| published-proof-of-concept| Telegram/LbSE4ui0deWaIbAIySI6HyoY8sH4t9aZhKhv-gkpgMW3iE 2025-06-13 17:35:32+00:00| seen|...

Brotli decompression bomb DoS

Description urllib3 can not stream brotli-encoded responses properly unlike the way it handles gzip responses. It always loads entire decompressed response body into memory when reading brotli-encoded response, which allows malicious servers to perform DoS attack by responding with decompression...

Full system file read and delete via GET /api/v1/images/download/{bulk_download_item_name}

Description For invokeai version v6.0.0a1 and below, there is an endpoint for bulk downloading zip file. With some manipulation of the filename arguments, attacker can read and also delete any files on the server through this endpoint. P/S: Tested on Windows Proof of Concept Request: GET...

Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage

A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...

CVE-2025-4584

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-5938

creationtimestamp| type| source ---|---|--- 2025-06-13 02:33:58+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18245 2025-06-13 05:11:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhoeb6taj2k...

CVE-2025-27689

creationtimestamp| type| source ---|---|--- 2025-06-12 21:34:40+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18233 2025-06-13 01:04:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhak33t4h2e 2025-06-13 06:05:09+00:00| seen|...

CVE-2025-21767

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05...

CVE-2025-44019

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07 2025-06-12 20:31:06+00:00| seen| Telegram/0yMPK4CpiDURHf7-h9WUwgfi4xtxnRXL0cNHjNvGP0ZDac 2025-06-12 20:34:16+00:00| seen|...

CVE-2025-35452

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10 2025-09-05 20:10:42+00:00| seen| https://t.me/canyoupwnme/6911 2025-09-06 06:01:22+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ly5iriwsde2...