CVE-2025-65953 NanoMQ UAF of retain message due to invalid MQTTV5 properties

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free UAF vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library specifically in src/sp/transport/mqtt/brokertcp.c. The vulnerability...

EUVD-2025-199658

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free UAF vulnerability exists in the TCP transport component of NanoMQ, which relies on the underlying NanoNNG library specifically in src/sp/transport/mqtt/brokertcp.c. The vulnerability...

REDAXO CMS is vulnerable to XSS through its module management component

A stored cross-site scripting XSS vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the...

"FOD" App uses hard-coded cryptographic keys

Overview "FOD" App provided by Fuji Television Network, Inc. uses hard-coded cryptographic keys Use of hard-coded cryptographic key CWE-321 - CVE-2025-64304 The keys are used in the processing of JWT data. Impact The cryptographic keys may be retrieved. The developer considers that the impact is...

REDAXO 安全漏洞

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO version 5.20.0, which stems from improper handling of the Output code field in the module management component and could lead to a stored cross-site scripting attack...

@asyncapi-actions-test/trusted-publishing-test_asyncapi-cli (>=4.1.3 <=5.4.0), @asyncapi/cli (>=5.0.1 <=6.0.2) +2 more potentially affected by unknown CVE via @asyncapi/modelina-cli (=5.10.1)

@asyncapi/modelina-cli NPM version =5.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/modelina-cli and may be impacted: - @asyncapi-actions-test/trusted-publishing-testasyncapi-cli =4.1.3, =5.0.1, =1.4.14, =1.4.50 -...

CVE-2025-63498

alinto SOGo 5.12.3 is vulnerable to Cross Site Scripting XSS via the "userName" parameter...

CVE-2025-11933

CVE-2025-11933 describes an issue in wolfSSL up to version 5.8.2 where improper input validation in the TLS 1.3 CKS extension parsing can allow a remote unauthenticated attacker to cause a denial‑of‑service with a crafted ClientHello containing duplicate CKS extensions. Affected software is wolfS...

CVE-2025-62709

ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...

CVE-2025-13357

Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication bypass. Thi...

CVE-2025-66083 WordPress WpEvently plugin <= 5.0.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through = 5.0.4...

CVE-2025-63888

The read function in file thinkphp\library\think\template\driver\File.php in ThinkPHP 5.0.24 contains a remote code execution vulnerability...

OPENSUSE-SU-2025:15756-1 blender-5.0-5.0.0-1.1 on GA media

These are all security issues fixed in the blender-5.0-5.0.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-11446

Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12...

EUVD-2025-198343

Improper input neutralization in the stats-conversions.php script in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes potential information disclosure and session hijacking via a stored XSS attack...

CVE-2025-52670

Missing authorization check in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes users on the system to delete banners owned by other accounts...

CVE-2025-48987

Improper Neutralization of Input in Revive Adserver 5.5.2 and 6.0.1 and earlier versions causes a potential reflected XSS attack...

CVE-2025-52670

Revive Adserver is affected by an IDOR-style authorization flaw in the banner deletion workflow. Multiple sources (CNVD, Red Hat, EUVD, NVD/NVD mirrors, OSV, CVE lists, and the HackerOne report) describe a missing ownership check when deleting banners, allowing a user to delete banners owned by a...

CVE-2025-62709

ClipBucket v5.5.2 is vulnerable to password reset link manipulation due to a code change in network.class.php that builds the server URL from the HTTP Host header when base_url is not configured. Because Host is user-controlled, an attacker can supply an arbitrary Host value, causing forget.php p...

CVE-2025-62709 ClipBucket v5 is vulnerable to password reset link manipulation

ClipBucket v5 is an open source video sharing platform. In ClipBucket version 5.5.2, a change to network.class.php causes the application to dynamically build the server URL from the incoming HTTP Host header when the configuration baseurl is not set. Because Host is a client-controlled header, a...