CVE-2025-65100

creationtimestamp| type| source ---|---|--- 2025-11-19 21:20:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5z6myvjpa2s...

CVE-2025-64765

Astro (web framework) vulnerability CVE-2025-64765 and related advisories describe a path normalization mismatch: Astro uses decodeURI for routing, while middleware reads context.url.pathname without the same normalization. This permits bypassing path-based authentication by double-encoded URLs (...

CVE-2024-8528

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

Apache Causeway vulnerable to deserialization in Java

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...

PT-2025-47455

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

Apache Causeway 安全漏洞

Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...

MAL-2025-191686 Malicious code in aws-enumerateiam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c108190780b32337fdce8748948935ac4229f0236710653f363b80a95dfbcd17 Before creating the boto3 client, package exfiltrates user's credentials. In this version, the exfiltrating is masked as connecting to an AWS component. The UR...

CVE-2025-13080

creationtimestamp| type| source ---|---|--- 2025-11-18 17:17:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5wamccvly2a...

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

CVE-2025-13230

creationtimestamp| type| source ---|---|--- 2025-11-18 01:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5ulipeouy2u 2025-11-18 07:51:18+00:00| seen| https://gist.github.com/Darkcrai86/3b9993543ef16c5ecbb901ec6a77f1eb 2025-12-09 08:41:36+00:00| seen|...

TOTOLINK A720R Command Injection Vulnerability (CNVD-2025-29710)

TOTOLINK A720R is a wireless router from China's Gion Electronics TOTOLINK with dual-band Wi-Fi capabilities, focusing on high-speed internet and signal coverage. The TOTOLINK A720R suffers from a command injection vulnerability that stems from the unvalidated magicid and url parameters in the...

SolarWinds Observability Self-Hosted 跨站脚本漏洞

SolarWinds Observability Self-Hosted is an observation platform from SolarWinds, Inc. A cross-site scripting vulnerability exists in SolarWinds Observability Self-Hosted, which stems from a cross-site scripting vulnerability in a user-created URL field that could lead to an attack by a...

CVE-2024-44660

creationtimestamp| type| source ---|---|--- 2025-11-17 21:30:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5u6b5lmsi2s...

CVE-2025-31649

creationtimestamp| type| source ---|---|--- 2025-11-17 14:30:05+00:00| seen| https://infosec.place/objects/c4fb9493-0d44-4262-9514-bf83eeef89f5 2025-11-18 01:11:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5uklz5skg2q...

EUVD-2025-197664

Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL. The unauthenticated URL can be discovered through basic network scanning techniques...

CVE-2025-60679

creationtimestamp| type| source ---|---|--- 2025-11-13 19:38:57+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115544079480228162 2025-11-13 21:05:16+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5k2yhtll42u...

GHSA-QWVM-X4XH-G2QQ

creationtimestamp| type| source ---|---|--- 2025-11-13 16:05:46+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115543241220528720...

CVE-2025-63645

creationtimestamp| type| source ---|---|--- 2025-11-13 00:15:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5hv5xrcxe2k...

CVE-2025-40204

creationtimestamp| type| source ---|---|--- 2025-11-13 00:04:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5hujm7aky2x 2025-12-23 14:37:06+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3manxwzrwls2r 2026-01-06 12:06:54+00:00| seen|...

Siemens SIMATIC S7-1500 Integer Overflow or Wraparound (CVE-2019-5435)

An integer overflow in curl's URL API results in a buffer overflow in libcurl 7.62.0 to and including 7.64.1. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if...