CVE-2025-53100 RestDB's Codehooks.io MCP Server Vulnerable to Command Injection

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated...

CVE-2025-34053

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34065

The CVE-2025-34065 vulnerability affects AVTECH IP cameras, DVRs, and NVRs (streamd web server). The issue is an authentication bypass where the strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls. Affected systems are AVTECH de...

CVE-2025-6706

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

ESPAsyncWebServer 注入漏洞

ESPAsyncWebServer is an asynchronous web server from the ESP32 Asynchronous Networking community for microcontrollers such as the ESP8266 and ESP32. An injection vulnerability exists in ESPAsyncWebServer version 3.7.8 and earlier, which stems from a CRLF injection in the HTTP header construction...

CVE-2025-6710

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which coul...

CVE-2025-52573

CVE-2025-52573 affects the iOS Simulator MCP Server (ios-simulator-mcp). The vulnerability arises in the MCP Server’s tool definitions (notably the ui_tap tool) which rely on Node.js child process API exec. When untrusted input is used for parameters such as duration, udid, x, and y, shell meta-c...

PT-2025-30925 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: A path traversal issue exists in Salesforce Tableau Server on Windows and Linux due to improper...

PT-2025-26973

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 6.0.21 MongoDB Server versions 7.0.0 through 7.0.16 MongoDB Server versions 8.0.0 through 8.0.4 Description: The MongoDB Server is susceptible to a denial of service issue due to improper handling of specific...

CVE-2025-49603

Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control...

PT-2025-30919 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: A flaw exists in Salesforce Tableau Server on Windows and Linux that allows an authorization bypass...

PT-2025-30923 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: An authorization bypass issue exists in Salesforce Tableau Server on Windows and Linux due to a...

MongoDB -- Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB

[email protected] reports: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the...

net/http: Request smuggling due to acceptance of invalid chunked data in net/http

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

[SECURITY] [DLA 4230-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4230-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort June 25, 2025 https://wiki.debian.org/LTS -...

Azure Linux 3.0 Security Update: mysql (CVE-2025-30682)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30682 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions th...

Azure Linux 3.0 Security Update: mysql (CVE-2024-20965)

The version of mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20965 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions th...

CBL Mariner 2.0 Security Update: mysql (CVE-2025-21577)

The version of mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-21577 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are...

PT-2025-26757

Name of the Vulnerable Software and Affected Versions CWP aka Control Web Panel or CentOS Web Panel versions prior to 0.9.8.1205 Description CWP Control Web Panel is susceptible to an unauthenticated remote code execution vulnerability. An attacker with knowledge of a valid, non-root username can...

[SECURITY] [DSA 5947-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5947-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso June 23, 2025 https://www.debian.org/security/faq -...