GHSA-5FPV-5QVH-7CF3 NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no...

NodeJS version of the HAX CMS application is distributed with Default Secrets

Summary The NodeJS version of the HAX CMS application is distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users aren't prompted to change credentials or secrets during installation, and there is no...

Security Bulletin: Critical Fixes for IBM Storage Defender - Data Protect included in 2.0.15

Summary IBM Storage Defender - Data Protect is vulnerable to CVE-2024-48910 and CVE-2024-47875. Fixes for these CVEs are included in version 2.0.15. Vulnerability Details CVEID:CVE-2024-48910 DESCRIPTION: DOMPurify could allow a remote authenticated attacker to execute arbitrary code on the syste...

CVE-2025-46382

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor...

CVE-2025-52164

Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to store credentials in plaintext...

CVE-2025-6233

Mattermost versions 10.8.x = 10.8.1, 10.7.x = 10.7.3, 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to sanitize input paths of file attachments in the bulk import JSONL file, which allows a system admin to read arbitrary system files via path traversal...

Tenda Ax1803 Stack Buffer Overflow Vulnerability

Tenda Ax1803 is a firmware product from Tenda that provides a range of features for network device setup and management. Users can use Tenda Ax1803 Firmware to perform network configuration, manage routers and other operations in a convenient and practical way. A stack buffer overflow vulnerabili...

apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

It was discovered that the ld.so.cache in images generated by apko had file system permissions mode 0666: bash-5.3 find / -type f -perm -o+w /etc/ld.so.cache...

EUVD-2025-21785

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and below 7.0.10 allows an unauthenticated attacker to execute unauthorized SQL code or commands v...

CVE-2025-47189

Netwrix Directory Manager formerly Imanami GroupID 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data of certain user flows, a different vulnerability than CVE-2025-54392...

AI Agents Act Like Employees With Root Access—Here's How to Regain Control

The AI gold rush is on. But without identity-first security, every deployment becomes an open door. Most organizations secure native AI like a web app, but it behaves more like a junior employee with root access and no manager. From Hype to High Stakes Generative AI has moved beyond the hype cycl...

Ubuntu: Security Advisory (USN-7633-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2025-5980 Malicious code in zeus-mex-profile-viz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38871f47fd1979b619cbf11895907214ada4c4f1edca195009d3fd9f4ac9fcc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-53024

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2025-53026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.1.10. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2025-30754

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; Oracle GraalVM for JDK: 17.0.15, 21.0.7 and 24.0....

CVE-2025-53025

...

CVE-2025-53023

Removed by vendor...

CVE-2025-50100

...

CVE-2025-50098

CVE-2025-50098 (MySQL Server, Oracle MySQL) affects MySQL Server components in Oracle MySQL, specifically the Server: Optimizer. Affected versions are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. The description indicates an easily exploitable vulnerability that requires network access with high pr...