CVE-2025-48468

CVE-2025-48468 centers on an open JTAG debug port that, with physical access, lets an attacker inject or modify firmware. Multiple connected sources tie this to Advantech industrial controllers (e.g., WISE-4010LAN, WISE-4050LAN, WISE-4060LAN) and describe the root cause as reliance on a JTAG inte...

CVE-2025-48461 Weak Session Cookie Entropy

Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset passwords...

Exploit for Allocation of Resources Without Limits or Throttling in Openbsd Openssh

CVE-2025-26466 Metasploit module OpenSSH versions 9.5p1 to...

PT-2025-26607

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 3.1.0 Description: The issue is related to the gateway proxy handler in MLflow, which lacks gateway path validation. This could potentially lead to exploitation. Recommendations: For versions prior to 3.1.0, update to...

QNAP File Station 5 Resource Management Error Vulnerability

QNAP File Station 5 is a file management system from Taiwan, China-based QNAP Technology QNAP. A resource management error vulnerability exists in QNAP File Station 5, which arises from an unrestricted resource allocation and can be exploited by an attacker to prevent other systems from accessing...

PT-2025-26654 · Unknown · Sifusm/Mzzyg Bd S1

Name of the Vulnerable Software and Affected Versions: SIFUSM/MZZYG BD S1 up to 20250611 Description: A vulnerability was found in the component RTSP Live Video Stream Endpoint, leading to improper access controls. Access to the local network is required for this attack to succeed. The exploit ha...

CVE-2025-6457

A vulnerability, which was classified as critical, was found in code-projects Online Hotel Reservation System 1.0. This affects an unknown part of the file /reservation/demo.php. The manipulation of the argument Start leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-6401 TOTOLINK N300RH HTTP POST Message formFilter denial of service

A vulnerability was found in TOTOLINK N300RH 6.1c.1390B20191101. It has been classified as problematic. This affects an unknown part of the file /boafrm/formFilter of the component HTTP POST Message Handler. The manipulation of the argument url leads to denial of service. The exploit has been...

PT-2025-26344 · Unknown · Wanotifier

Name of the Vulnerable Software and Affected Versions: WANotifier versions through 2.7.7 Description: The issue is related to a Missing Authorization vulnerability in WANotifier, allowing the exploitation of incorrectly configured access control security levels. Recommendations: For versions...

Cisco Meraki MX and Z Series AnyConnect VPN with Client Certificate Authentication Denial of Service Vulnerability

A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series Teleworker Gateway devices could allow an unauthenticated, remote attacker to cause a denial of service DoS condition in the Cisco AnyConnect service on an affected device. This vulnerability is due to...

CVE-2025-4820

CVE-2025-4020 (CVE-2025-4820) affects the Cloudflare quiche library. The issue is an incorrect congestion window growth caused by an opportunistic ACK attack (RFC 9000, §21.4) that can allow a victim to send more data in flight than the path supports. An unauthenticated remote attacker can comple...

CVE-2025-30642

A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service DoS situation on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploi...

Dover Fueling Solutions ProGauge MagLink LX consoles

RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker gaining control of the monitoring device, manipulating fueling operations, deleting system configurations, or deploying malware. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

Various ABB products information leakage vulnerability

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

Cross-Site Scripting Vulnerability in Various ABB Products

ABB ASPECT-Enterprise is a scalable building energy management and control solution.ABB NEXUS Series is a monitoring and control management system.ABB MATRIX Series is an embedded IoT ASPECT control engine designed to provide flexible field control for medium to large field control applications. ...

PT-2025-25527 · Tenda · Tenda Fh1205

Name of the Vulnerable Software and Affected Versions: Tenda FH1205 version 2.0.0.7775 Description: A critical vulnerability was found in the Tenda FH1205, affecting the fromVirtualSer function of the file /goform/VirtualSer. The manipulation of the argument page leads to a stack-based buffer...

ROS-20250616-10

The vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms is related to the fact that the software saves confidential information in log files when processing incorrect data using the KVv2 plug-in. processing incorrect data using the KVv2 plug-in...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2025-15820)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager Cross-Site Scripting Vulnerability

Adobe Experience Manager is a comprehensive content management solution from Adobe. Adobe Experience Manager suffers from a cross-site scripting vulnerability that stems from a stored cross-site scripting vulnerability that can be exploited by an attacker to cause malicious script execution...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-14987)

Adobe Experience Manager is a comprehensive content management solution from Adobe. A cross-site scripting vulnerability exists in Adobe Experience Manager, which stems from the vulnerability of form fields to stored cross-site scripting attacks. An attacker can exploit the vulnerability to cause...