CVE-2025-57758

Contao CMS vulnerability CVE-2025-57758 affects Contao Core (versions from 5.0.0 up to, but not including, 5.3.38 and 5.6.1). The back-end table access voter fails to verify whether a user is allowed to access the target module, enabling improper access control. Patches are implemented in Contao ...

CVE-2025-57757 Contao discloses information in the news module

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround...

CVE-2025-57757 Contao discloses information in the news module

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround...

Improper Handling of Exceptional Conditions

Overview @plone/volto is a Volto Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via accessing a specific URL as an anonymous user. An attacker can cause the server process to terminate unexpectedly by sending crafted requests to the affected...

CVE-2025-57767 Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.15.2, 21.10.2, and 22.5.2, if a SIP request is received with an Authorization header that contains a realm that wasn't in a previous 401 response's WWW-Authenticate header, or an Authorization header wi...

Contao discloses sensitive information in the front end search index

Impact Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. Patches Update to Contao 4.13.56, 5.3.38 or 5.6.1. Workarounds Disable the front end search. For more information If you have any questions or comments about this...

PT-2025-35103

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 5.3.38 Contao versions prior to 5.6.1 Description: Contao is an Open Source CMS. News items from protected news archives within a news feed are not filtered and become publicly available in the RSS feed. A workaround...

PT-2025-35111

Name of the Vulnerable Software and Affected Versions: NeuVector versions prior to 5.4.6 Description: NeuVector process handling can lead to the leakage of sensitive arguments, such as passwords, within security event logs. The software uses regular expressions to detect and redact sensitive data...

Cisco Nexus Dashboard Path Traversal Vulnerability

A vulnerability in the backup restore functionality of Cisco Nexus Dashboard could allow an authenticated, remote attacker to conduct a path traversal attack on an affected device. This vulnerability is due to insufficient validation of the contents of a backup file. An attacker with valid...

Cisco NX-OS Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute a command injection attack on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. This...

Linux Distros Unpatched Vulnerability : CVE-2021-41116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are...

Linux Distros Unpatched Vulnerability : CVE-2022-24883

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful f...

Linux Distros Unpatched Vulnerability : CVE-2025-30194

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illega...

Linux Distros Unpatched Vulnerability : CVE-2021-43861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams...

PT-2025-34907 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FoxCMS version 1.2.6 Description: FoxCMS is susceptible to a reflected Cross Site Scripting XSS issue in the /index.php/plus endpoint. Recommendations: As a temporary workaround, consider restricting access to the /index.php/plus endpoint unt...

Linux Distros Unpatched Vulnerability : CVE-2022-21670

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser...

PT-2025-34854 · Unknown · Preparecdexportjson.Pl

Name of the Vulnerable Software and Affected Versions: PrepareCDExportJSON.pl affected versions not specified Description: The getPerfServiceIds function within the PrepareCDExportJSON.pl service is susceptible to SQL injection. This allows for potential manipulation of database queries through...

Linux Distros Unpatched Vulnerability : CVE-2023-41335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. When users update their passwords, the new credentials may be...

PT-2025-34942 · Dahua · Dahua Eims

Name of the Vulnerable Software and Affected Versions: Dahua EIMS versions prior to 2240008 Description: A command injection flaw in Dahua EIMS allows unauthenticated remote attackers to execute arbitrary system commands. This is due to improper input validation in the captureCommand parameter of...

Linux Distros Unpatched Vulnerability : CVE-2025-29785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to...