PT-2025-34752 · Unknown · Mojoomla School Management

Name of the Vulnerable Software and Affected Versions: Mojoomla School Management versions prior to 93.2.0 Description: A missing authorization flaw in Mojoomla School Management allows exploitation of incorrectly configured access control security levels. Recommendations: Update Mojoomla School...

WordPress plugin Simpler Checkout 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

Claude Code Router 安全漏洞

Claude Code Router is an enhancement to the flexibility and customizability of Claude Code by musi individual developers. A security vulnerability exists in Claude Code Router versions prior to 1.0.34, which stems from a misconfiguration of cross-resource sharing that could lead to credential...

Appneta Tcpreplay 资源管理错误漏洞

Appneta Tcpreplay is a suite of open source utilities for editing and replaying network traffic on UNIX-based operating systems from Appneta, Inc. A resource management error vulnerability exists in Appneta Tcpreplay 4.5.2-beta2 and earlier versions, which stems from a post-release reuse issue in...

Linux Distros Unpatched Vulnerability : CVE-2018-6079

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate sharing of TEXTURE2DARRAY/TEXTURE3D data between tabs in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to leak...

CVE-2025-8943 Unsupervised OS command execution leads to remote code execution by unauthenticated network attackers

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like npx to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls RBAC. Furthermore, in Flowise versions before 3.0.1 the...

PT-2025-33059 · Portabilis · Portabilis I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions prior to 1.7 Description: A cross-site scripting issue exists in Portabilis i-Diario due to manipulation of the código/objetivo habilidade argument within an unknown function of the...

EulerOS 2.0 SP11 : sudo (EulerOS-SA-2025-1944)

According to the versions of the sudo package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute...

Intel TDX Module software 缓冲区错误漏洞

Intel TDX Module software is a collection of software modules from Intel Corporation USA. A buffer error vulnerability exists in versions of Intel TDX module software prior to TDX1.5.07.00.774, which originates from an out-of-bounds read and could lead to information disclosure...

PT-2025-32653 · Siemens · Simatic Rtls Locating Manager

Name of the Vulnerable Software and Affected Versions: SIMATIC RTLS Locating Manager versions prior to V3.2 Description: A vulnerability exists in SIMATIC RTLS Locating Manager that allows an authenticated remote attacker with high privileges to execute arbitrary code with 'NT Authority/SYSTEM'...

CVE-2025-38747

Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated attacker could potentially exploit this vulnerability, leading to Elevation of Privileges...

Linux Distros Unpatched Vulnerability : CVE-2024-21247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Client product of Oracle MySQL component: Client: mysqldump. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and pri...

GHSA-856V-8QM2-9WJV operator-sdk: privilege escalation due to incorrect permissions of /etc/passwd

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, usersetup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used...

CVE-2025-5921

CVE-2025-5921 affects the SureForms WordPress plugin prior to version 1.7.2. The vulnerability is a Reflected Cross-Site Scripting caused by insufficient sanitisation/escaping of a parameter before output, potentially exploitable against both authenticated and unauthenticated users. Remediation: ...

CVE-2025-4285

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Rolantis Information Technologies Agentis allows SQL Injection. This issue affects Agentis: before 4.32...

Mbed TLS 安全漏洞

Mbed TLS is an open source, portable, easy to use, readable and flexible SSL library from Mbed TLS Open Source. A security vulnerability exists in Mbed TLS versions prior to 3.6.4 that stems from a null pointer dereference...

CVE-2025-34118

A path traversal vulnerability exists in Linknat VOS Manager versions prior to 2.1.9.07, including VOS2009 and early VOS3000 builds, that allows unauthenticated remote attackers to read arbitrary files on the server. The vulnerability is accessible via multiple localized subpaths such as '/eng/',...

CVE-2025-7673

A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50ABOM.5C0 could allow an unauthenticated attacker to cause denial-of-service DoS conditions and potentially execute arbitrary code by sending a specially crafted HTTP...

Microsoft Edge (Chromium) < 138.0.3351.95 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 138.0.3351.95. It is, therefore, affected by multiple vulnerabilities as referenced in the July 16, 2025 advisory. - Use after free in WebRTC in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to...

Zoom Workplace < 6.4.0 Vulnerability (ZSB-25028)

The version of Zoom Workplace installed on the remote host is prior to 6.4.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-25028 advisory. - Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via networ...