The vulnerability of the monitoring tool for Synthetics in the Kibana data visualization service allows a violator to increase their privileges.

The vulnerability of the monitoring tool for Synthetics in the Kibana data visualization service is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to increase their privileges by sending a specially crafted HTTP request...

The vulnerability of the IDE Assets component in the Xcode development environment allows a hacker to gain unauthorized access to protected information.

The vulnerability of the IDE Assets component in the Xcode development environment is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Enterprise Event Enablement component of the SAP S/4HANA software platform allows a malicious actor to elevate their privileges and execute arbitrary code.

The vulnerability of the Enterprise Event Enablement component of the SAP S/4HANA software platform is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to enhance their privileges and execute arbitrary code...

The vulnerability of the PROFINET protocol implementation in the modular safety system SIRIUS 3RK3 and the safety relay software SIRIUS 3SK2 allows a intruder to disclose protected information.

The vulnerability of the PROFINET protocol implementation in the modular safety system SIRIUS 3RK3 and the safety relay software SIRIUS 3SK2 is related to a weak password obfuscation during data transmission. Exploiting this vulnerability could allow an attacker, operating remotely, to disclose t...

PYSEC-2025-221

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

CVE-2025-43866 Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is...

No CWE? No Excuse. Why Classification Gaps Are a Hacker’s Dream

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on CAASM & CDMB Inefficiencies! In cybersecurity, we obsess over...

Palo Alto Networks Prisma Access Browser 安全漏洞

Palo Alto Networks Prisma Access Browser is an enterprise security browser from Palo Alto Networks, Inc. A security vulnerability exists in Palo Alto Networks Prisma Access Browser that stems from an insufficient cache implementation that could lead to the bypassing of data control policies...

CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

SAP S/4HANA 安全漏洞

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from insufficient authorization checking and could result in the deletion of attachments...

The vulnerability of the RP_UpgradeFWByBBS() function in the microprogrammed software for Linksys wireless signal amplifiers allows a intruder to execute arbitrary commands.

The vulnerability of the RPUpgradeFWByBBS function in the Linksys wireless signal amplifiers’ software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands by sending a specially crafted...

CVE-2025-5646

creationtimestamp| type| source ---|---|--- 2025-06-05 08:47:29+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqtwoot3hzv2 2025-06-05 11:22:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqu7ekpprg2s...

RSJoomla! RSBlog! 跨站脚本漏洞

RSJoomla! RSBlog! is a blog management tool from RSJoomla! A cross-site scripting vulnerability exists in RSJoomla! RSBlog! versions 1.11.6 through 1.14.4, which stems from insufficient input cleanup and could lead to a stored cross-site scripting attack...

CVE-2025-47725 Out-of-bounds Write in CNCSoft

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

The vulnerability of the IBM Guardium Data Protection platform regarding data security protection, related to deficiencies in the authentication mechanism, allows attackers to disclose the protected information.

The vulnerability of the IBM Guardium Data Protection platform relates to deficiencies in its authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose the protected information...

CloudClassroom-PHP-Project SQL注入漏洞

CloudClassroom-PHP-Project is a cloud classroom website by the individual developer Vishal Mathur. A security vulnerability exists in CloudClassroom-PHP-Project version 1.0, which stems from insufficient validation of the myds parameter in mydetailsstudent.php, which could lead to a SQL injection...

Debian dla-4195 : krb5-admin-server - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4195 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4195-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

GHSA-C65P-X677-FGJ6 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary In the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes, which returns only the raw pixel data, without including metadata such as the...

Avast Business Antivirus 安全漏洞

Avast Business Antivirus is a commercial network antivirus from Avast. A security vulnerability exists in Avast Business Antivirus version 4.5, which stems from insufficient file validation and could lead to tampering of update files...