CVE-2025-66386

creationtimestamp| type| source ---|---|--- 2025-11-28 10:54:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6optmticc2x 2025-12-03 19:49:28+00:00| seen| https://bsky.app/profile/getpokemon7.bsky.social/post/3m74a3bsoik2j...

Use Of Externally-Controlled Input To Select Classes Or Code ('Unsafe Reflection')

Astro is vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection'. The vulnerability is due to Astro reflecting the unvalidated X-Forwarded-Host header in Astro.url, which allows an attacker to supply a malicious header value that can manipulate generated...

CVE-2025-13467

creationtimestamp| type| source ---|---|--- 2025-11-25 17:38:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m6huz2vixn2k...

Oracle Fusion Middleware Identity Manager authentication bypass

Added: 11/24/2025 Background Oracle Fusion Middleware is a platform for creating and running applications. Problem An authentication bypass vulnerability in the Identity Manager component allows remote attackers to execute arbitrary commands by appending ;.wadl to a URL. Resolution See Oracle Pat...

Google Cloud Looker 安全漏洞

Google Cloud Looker is an online tool from Google USA for converting data into customizable and informative reports and dashboards. A security vulnerability exists in Google Cloud Looker that stems from a malicious URL construction issue that could lead to the execution of attacker-supplied scrip...

Apache Causeway Deserialization Vulnerability

Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...

CVE-2025-13548

A vulnerability has been found in D-Link DIR-822K and DWR-M920 1.0020250513164613/1.1.50. This vulnerability affects unknown code of the file /boafrm/formFirewallAdv. Such manipulation of the argument submit-url leads to buffer overflow. The attack may be launched remotely. The exploit has been...

CVE-2024-1045

creationtimestamp| type| source ---|---|--- 2025-11-21 18:31:26+00:00| seen| https://bsky.app/profile/ferramentaslinux.bsky.social/post/3m65w4mkfek2q...

Denial-of-service (DoS)

@plone/volto is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of a specific URL request, which allows an attacker to crash the NodeJS server component by simply visiting that crafted URL...

CVE-2025-65100

creationtimestamp| type| source ---|---|--- 2025-11-19 21:20:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5z6myvjpa2s...

CVE-2025-64765

Astro (web framework) vulnerability CVE-2025-64765 and related advisories describe a path normalization mismatch: Astro uses decodeURI for routing, while middleware reads context.url.pathname without the same normalization. This permits bypassing path-based authentication by double-encoded URLs (...

CVE-2024-8528

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

Apache Causeway vulnerable to deserialization in Java

Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution RCE through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary cod...

PT-2025-47455

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

Apache Causeway 安全漏洞

Apache Causeway is the Apache Foundation of a Java rapid application development framework . Apache Causeway suffers from a deserialization vulnerability that originates from unsafe deserialization of user-controllable URL parameters in the receipt of serialized data submitted by the user, which...

The vulnerability of the Git-based software platform for collaborative code development on GitLab arises from incorrect handling of data related to URL encoding. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to improper handling of data with URL encoding. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

MAL-2025-191686 Malicious code in aws-enumerateiam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c108190780b32337fdce8748948935ac4229f0236710653f363b80a95dfbcd17 Before creating the boto3 client, package exfiltrates user's credentials. In this version, the exfiltrating is masked as connecting to an AWS component. The UR...

CVE-2025-13080

creationtimestamp| type| source ---|---|--- 2025-11-18 17:17:47+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5wamccvly2a...

CVE-2025-55179

Incomplete validation of rich response messages in WhatsApp for iOS prior to v2.25.23.73, WhatsApp Business for iOS v2.25.23.82, and WhatsApp for Mac v2.25.23.83 could have allowed a user to trigger processing of media content from an arbitrary URL on another user’s device. We have not seen...

CVE-2025-13230

creationtimestamp| type| source ---|---|--- 2025-11-18 01:27:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5ulipeouy2u 2025-11-18 07:51:18+00:00| seen| https://gist.github.com/Darkcrai86/3b9993543ef16c5ecbb901ec6a77f1eb 2025-12-09 08:41:36+00:00| seen|...