CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

WordPress AI Engine Plugin MCP Unauthenticated Admin Creation to RCE

This module exploits an unauthenticated vulnerability in the WordPress AI Engine plugin versions use exploit/multi/http/wp/aienginemcprce msf undefinedaienginemcprce show actions ...actions... msf undefinedaienginemcprce set ACTION msf undefinedaienginemcprce show options ...show and set options...

GHSA-H238-5MWF-8XW8 lakeFS affected by unauthenticated access to API usage metrics

Impact Missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may reveal information about service activity or uptime. Patches Upgrade to v1.70.1 Workarounds Any ONE of these is...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the /api/v1/usage-report/summary endpoint. An attacker can access aggregate API usage counts by sending unauthenticated requests to this endpoint, potentially revealing information about service activity or...

EUVD-2025-37512

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-50735

Directory traversal vulnerability in NextChat thru 2.16.0 due to the WebDAV proxy failing to canonicalize or reject dot path segments in its catch-all route, allowing attackers to gain sensitive information via authenticated or anonymous WebDAV endpoints...

CVE-2025-50735

A directory traversal vulnerability exists in NextChat versions through 2.16.0 . The flaw is caused by the WebDAV proxy failing to canonicalize or reject dot path segments within its catch-all route. This oversight allows an attacker to access sensitive information via both authenticated and anon...

Malicious Package

Overview new-route-matrix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: virtio-net: The recursive rtnllock function occurs during the probe operation. This deadlock appears in a stack trace like this: virtnetprobe rtnllock virtioconfigChangedWork netdevNotifyPeers rtnllock This occurs when the VMM...

EUVD-2025-37292

Malicious code in new-route-matrix npm...

Malicious code in new-route-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ee2159cd9cc77ad5a88ac059f6c816cf1b9b4ec1e8148c4bb75cd1bf5a5244 The package new-route-matrix was found to contain malicious code. Source: ghsa-malware 8be55d07fc4dd84c7c769d8ec2f62de2eb9fea7a60664d2eac8fd91f757a1e...

MAL-2025-49300 Malicious code in new-route-matrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ee2159cd9cc77ad5a88ac059f6c816cf1b9b4ec1e8148c4bb75cd1bf5a5244 The package new-route-matrix was found to contain malicious code. Source: ghsa-malware 8be55d07fc4dd84c7c769d8ec2f62de2eb9fea7a60664d2eac8fd91f757a1e...

PT-2025-44579

Name of the Vulnerable Software and Affected Versions RealPress WordPress plugin versions prior to 1.1.0 Description The RealPress WordPress plugin does not properly validate permissions when registering REST routes. This allows for the creation of pages and the sending of emails on the site...

D-Link DIR600L formSetRoute function buffer overflow vulnerability

D-Link DIR600L is a wireless router for home users, belonging to D-Link's "Cloud Router" series, with an external antenna design, supporting 802.11n standard, with a maximum wireless transmission rate of 150Mbps. The D-Link DIR600L suffers from a buffer overflow vulnerability, which originates fr...

CVE-2025-12271

A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used...

EUVD-2025-36173

An issue was discovered in eTimeTrackLite Web thru 12.0 20250704. There is a permission control flaw that allows unauthorized attackers to access specific routes and modify database connection configurations...

CVE-2025-12271

A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used...

CVE-2025-12271

A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used...

EUVD-2025-36166

A vulnerability was identified in Tenda CH22 1.0.0.1. This affects the function fromRouteStatic of the file /goform/RouteStatic. Such manipulation of the argument page leads to buffer overflow. The attack can be launched remotely. The exploit is publicly available and might be used...