CVE-2025-31324 Missing Authorization check in SAP NetWeaver (Visual Composer development server)

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...

CVE-2025-30686

...

BIT-RCLONE-2024-52522 Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target...

Advisory ROSA-SA-2025-2813

Software: net-snmp 5.8 OS: ROSA Virtualization 3.0 packageevrstring: net-snmp-5.8-30.0.1.rv30 CVE-ID: CVE-2022-24805 BDU-ID: 2024-06509 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the NET-SNMP-VACM-MIB function of the Net-SNMP software suite of the Linux operating system is related to buffer...

PT-2025-15376 · Sap · Sap Landscape Transformation

Name of the Vulnerable Software and Affected Versions: SAP Landscape Transformation SLT affected versions not specified Description: The issue allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC, enabling the injection of arbitrary ABAP code...

PT-2025-15163 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A security issue exists in the security verification module, specifically an access control vulnerability. Successful exploitation of this issue will impact the integrity and confidentiality...

PT-2025-15164 · Huawei · Emui +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A security issue exists in the security verification module, specifically an access control vulnerability. Successful exploitation of this issue will impact the integrity and confidentiality...

CVE-2025-28131

A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enablin...

CVE-2025-28131

A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enablin...

Security Bulletin: Multiple vulnerabilities in IBM® SDK, Java™ Technology Edition affect IBM Storage Protect Operations Center (CVE-2024-21235, CVE-2024-21217, CVE-2024-21210, CVE-2024-21208, CVE-2024-10917).

Summary IBM Storage Protect Operations Center may be affected by multiple vulnerabilities in the IBM® SDK Java™ Technology Edition, Version 8. These vulnerabilities could potentially result in denial-of-service DoS, data loss, and compromise the availability and integrity of the host system...

CVE-2025-28131

A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform administrative actions, including stopping system services and deleting critical resources. This flaw arises due to improper authorization enforcement, enablin...

CVE-2025-28131

CVE-2025-28131 concerns a Broken Access Control in Nagios Network Analyzer 2024R1.0.3. Multiple sources describe that low-privilege users with Read-Only access can perform administrative actions (e.g., stopping system services and deleting critical resources) due to improper authorization enforce...

CVE-2025-24282

A library injection issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected parts of the file system...

MAL-2025-2787 Malicious code in smart-file-renamer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28b650ad09355a36c0fcdb91255b1bcb59984a12295de8a0a88ac5735c29f7f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the amdgpudebugfs regs_smc_read() function in the drivers/gpu/drm/amd/amdgpu/amdgpudebugfs.c module of the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the amdgpudebugfs regssmcread function in the drivers/gpu/drm/amd/amdgpu/amdgpudebugfs.c module of the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could...

CVE-2024-10361

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

AgentScope Cross-Origin Resource Sharing (CORS) vulnerability

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

CVE-2024-8487

A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...

CVE-2024-10361

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2024-10273

In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endpoint for models does not have appropriate privilege checks, enabling low-privilege users to update models they should not have access to...