CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

Linksys wireless signal amplifiers arbitrary command execution

The vulnerability of the RPUpgradeFWByBBS function in the Linksys wireless signal amplifiers’ software relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands by sending a specially crafted...

SAP S/4HANA security vulnerabilities

SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system from SAP, Germany. A security vulnerability exists in SAP S/4HANA that stems from insufficient authorization checking and could result in the deletion of attachments...

CVE-2025-5646

creationtimestamp| type| source ---|---|--- 2025-06-05 08:47:29+00:00| seen| https://bsky.app/profile/FunctionalProgramming.activitypub.awakari.com.ap.brid.gy/post/3lqtwoot3hzv2 2025-06-05 11:22:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqu7ekpprg2s...

RSJoomla! RSBlog! Cross-site scripting vulnerabilities

RSJoomla! RSBlog! is a blog management tool from RSJoomla! A cross-site scripting vulnerability exists in RSJoomla! RSBlog! versions 1.11.6 through 1.14.4, which stems from insufficient input cleanup and could lead to a stored cross-site scripting attack...

CVE-2025-47725 Out-of-bounds Write in CNCSoft

Delta Electronics CNCSoft lacks proper validation of the user-supplied file. If a user opens a malicious file, an attacker can leverage this vulnerability to execute code in the context of the current process...

IBM Guardium Data Protection Auth Bypass Info Disclosure

The vulnerability of the IBM Guardium Data Protection platform relates to deficiencies in its authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to disclose the protected information...

CloudClassroom-PHP-Project SQL Injection Vulnerability

CloudClassroom-PHP-Project is a cloud classroom website by the individual developer Vishal Mathur. A security vulnerability exists in CloudClassroom-PHP-Project version 1.0, which stems from insufficient validation of the myds parameter in mydetailsstudent.php, which could lead to a SQL injection...

Debian dla-4195 : krb5-admin-server - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4195 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4195-1 [email protected] https://www.debian.org/lts/security/...

CVE-2025-46722 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

vLLM is an inference and serving engine for large language models LLMs. In versions starting from 0.7.0 to before 0.9.0, in the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image...

GHSA-C65P-X677-FGJ6 vLLM has a Weakness in MultiModalHasher Image Hashing Implementation

Summary In the file vllm/multimodal/hasher.py, the MultiModalHasher class has a security and data integrity issue in its image hashing method. Currently, it serializes PIL.Image.Image objects using only obj.tobytes, which returns only the raw pixel data, without including metadata such as the...

Avast Business Antivirus security vulnerability

Avast Business Antivirus is a commercial network antivirus from Avast. A security vulnerability exists in Avast Business Antivirus version 4.5, which stems from insufficient file validation and could lead to tampering of update files...

Retail Under Siege: What Recent Cyber Attacks Tell Us About Today’s Threat Landscape

When several major UK organizations, including well-known retail brands, found themselves caught in a cyber attack earlier this year, it made headlines. But this incident wasn’t the first, and it won’t be the last. It reflects a growing trend where attackers exploit third-party vendors to breach...

ProactivaNet security vulnerabilities

ProactivaNet is an IT service and IT asset management software from ProactivaNet designed for large organizations. A security vulnerability exists in ProactivaNet version v3.24.0.0 that stems from improper privilege management and could result in elevated privileges...

WordPress plugin Exclusive Addons for Elementor: Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in...

CVE-2025-32967

OpenEMR prior to version 7.0.3.4 has a logging oversight where password change events are not recorded in the client-side log viewer, weakening traceability and potentially enabling undetectable internal or external misuse. The vulnerability affects the OpenEMR EHR/PM application and is addressed...

CVE-2025-21539

Vulnerability in the PeopleSoft Enterprise FIN eSettlements product of Oracle PeopleSoft component: eSettlements. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN...

CVE-2024-47943

The firmware upgrade function in the admin web interface of the Rittal IoT Interface & CMC III Processing Unit devices checks if the patch files are signed before executing the containing run.sh script. The signing process is kind of an HMAC with a long string as key which is hard-coded in the...

CVE-2024-20280

A vulnerability in the backup feature of Cisco UCS Central Software could allow an attacker with access to a backup file to learn sensitive information that is stored in the full state and configuration backup files. This vulnerability is due to a weakness in the encryption method that is used fo...

CVE-2024-8692

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...