CVE-2025-62513 OpenBao leaks HTTPRawBody in Audit Logs

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

EUVD-2025-35626

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

CVE-2025-62513

OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...

CVE-2025-61220

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information...

Hono Improper Authorization vulnerability

Improper Authorization in Hono JWT Audience Validation Hono’s JWT authentication middleware did not validate the aud Audience claim by default. As a result, applications using the middleware without an explicit audience check could accept tokens intended for other audiences, leading to potential...

CVE-2025-41722

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices...

CVE-2025-41722

CVE-2025-41722 : The set of connected sources confirms a vulnerability in the wsc server where a hard-coded certificate is used to verify SOAP messages. This configuration enables an unauthenticated remote attacker to extract private keys from the affected devices. The issue is tied to multiple a...

EUVD-2025-35333

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified...

CVE-2025-41720 Sauter: Arbitrary File Upload

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified...

PT-2025-43405

Name of the Vulnerable Software and Affected Versions Hono versions 1.1.0 through 4.10.1 Description Hono’s JWT authentication middleware lacked built-in verification of the aud Audience claim. This could lead to confused-deputy or token-mix-up issues, where an API might accept a valid token...

Security Advisory 0124

Security Advisory 0124 PDF Date: October 22, 2025 Revision | Date | Changes ---|---|--- 1.0 | October 22, 2025 | Initial release The following issues were discovered in Arista DANZ Monitoring Fabric DMF. These issues affect DMF, Converged Cloud Fabric CCF, CloudVision Appliance CVA, and Multi-Clo...

Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability

Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets...

JLSEC-2025-184 libgit2 is a cross-platform, linkable library implementation of Git

libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the certificatecheck field of libgit2's gitremotecallbacks...

EUVD-2025-35189

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information...

CVE-2025-61220

The incomplete verification mechanism in the AutoBizLine com.mysecondline.app 1.2.91 allows attackers to log in as other users and gain unauthorized access to their personal information...

CVE-2025-11625 Host verification bypass and credential leak

Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of clients credentials...

CVE-2025-11625

The CVE-2025-11625 entry concerns wolfSSH (client) versions 1.4.20 and earlier with an improper host authentication flaw that can permit authentication bypass and leakage of client credentials. Multiple sources (NVD, Red Hat, EUVD, OSV, CVE list, CNVD, CIRCL, etc.) describe the issue across wolfS...

EUVD-2022-54959

In the Linux kernel, the following vulnerability has been resolved: mmc: core: use sysfsemit instead of sprintf sprintf still used in the MMC core for the sysfs output is vulnerable to the buffer overflow. Use the new-fangled sysfsemit instead. Found by Linux Verification Center linuxtesting.org...

CVE-2025-56224

A lack of rate limiting in the One-Time Password OTP verification endpoint of SigningHub v8.6.8 allows attackers to bypass verification via a bruteforce attack...

CVE-2025-61220

The CVE-2025-61220 entry concerns AutoBizLine, app package com.mysecondline.app, version 1.2.91, where an incomplete verification/authentication mechanism permits an attacker to log in as other users and access their personal information. The Red Hat, ENISA EUVD, CIRCL, NVD, and other feeds corro...