CVE-2025-42910

Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an...

EUVD-2025-34120

Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malware. On successful exploitation an...

CVE-2025-42910

CVE-2025-42910 affects SAP Supplier Relationship Management (SRM). The issue stems from missing verification of uploaded file type/content, allowing an authenticated attacker to upload arbitrary files (potentially executable). Successful exploitation could impact confidentiality, integrity, and a...

PT-2026-37102

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0 Description Broken TLS validation logic in the OVN database connection logic allows connections to an attacker's OVN database. The OVN client implementations disable standard Go TLS server verification and use a...

PT-2025-42148

Name of the Vulnerable Software and Affected Versions GitHub affected versions not specified Description An improper verification of a cryptographic signature allows an unauthorized attacker to perform spoofing over an adjacent network. Recommendations At the moment, there is no information about...

PT-2025-41842

Name of the Vulnerable Software and Affected Versions SAP Supplier Relationship Management affected versions not specified Description SAP Supplier Relationship Management does not properly verify the type or content of uploaded files. This allows an authenticated attacker to upload arbitrary...

IGEL OS Use of a Key Past its Expiration Date Vulnerability

IGEL OS contains a use of a key past its expiration date vulnerability that allows for Secure Boot bypass. The igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image...

PT-2025-41954

Name of the Vulnerable Software and Affected Versions FortiClient versions 7.0 through 7.2.9 FortiClient versions 7.4.2 and below Description An issue exists in FortiClient for macOS where improper verification of cryptographic signatures may allow a local user to escalate privileges through...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the exsltFuncResultComp function during the verification of EXSLT . An attacker can cause application crashes or instability by submitting a specially crafted XSL stylesheet...

PT-2025-42226

CVE-2025-56224 CVE-2025-56224 OTP verification Bypass Description an attacker can impersonate another user mobile number and use this vulnerability to verify the number without knowing the OTP code. CVSS Score https://t.co/9m2AguFoY6...

KB5066837: Windows 10 LTS 1507 Security Update (October 2025)

The remote Windows host is missing security update 5066837. It is, therefore, affected by multiple vulnerabilities - tifpredict.h and tifpredict.c in libtiff 4.0.6 have assertions that can lead to assertion failures in debug mode, or buffer overflows in release mode, when dealing with unusual til...

CVE-2025-61775

Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address...

CVE-2025-61775

The CVE-2025-61775 entry concerns Vickey, a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 whereby unexpired email confirmation links can be reused multiple times to trigger repeated confirmation emails to a verified address. Under certain condit...

CVE-2025-61775 Vickey's unexpired email confirmation link can be reused to send repeated confirmation emails

Vickey is a Misskey-based microblogging platform. A vulnerability exists in Vickey prior to version 2025.10.0 where unexpired email confirmation links can be reused multiple times to send repeated confirmation emails to a verified email address. Under certain conditions, a verified email address...

EUVD-2025-34057

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...

CVE-2025-9265

A broken authorization vulnerability in Kiloview NDI N30 allows a remote unauthenticated attacker to deactivate user verification, giving them access to state changing actions that should only be initiated by administratorsThis issue affects Kiloview NDI N30 and was fixed in Firmware version late...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the application not verifying the content type of uploaded attachments or user avatars and serving the data back as is, which allows an authenticated attacker to inject malicious scripts that execute...

WordPress Chatwee plugin cross-site request forgery vulnerability

WordPress Chatwee plugin is a plugin for adding live chat functionality to your WordPress website with multi-language and internationalization support. The WordPress Chatwee plugin suffers from a cross-site request forgery vulnerability that stems from the WEB application not adequately verifying...

PT-2025-41796

Name of the Vulnerable Software and Affected Versions Vickey versions prior to 2025.10.0 Description Vickey, a Misskey-based microblogging platform, has an issue where unexpired email confirmation links can be reused multiple times, leading to repeated confirmation emails being sent to a verified...

Attacks by Content: Automated Fact-Checking Is an AI Security Issue

When AI agents retrieve and reason over external documents, adversaries can manipulate the data they receive to subvert their behaviour. Previous research has studied indirect prompt injection, where the attacker injects malicious instructions. We argue that injection of instructions is not...