PT-2025-32769 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: A missing synchronization flaw in Windows Hyper-V can allow an authorized attacker to cause a denial of service to an adjacent network. Recommendations: At the moment, there is no...

PT-2025-32747 · Unknown · Edge Orchestrator

Name of the Vulnerable Software and Affected Versions: Edge Orchestrator versions prior to 24.11.1 Description: An uncontrolled resource consumption issue in some Edge Orchestrator software may allow an authenticated user to potentially enable a denial of service via adjacent access...

PT-2025-32612 · Sap · Sap Cloud Connector

Name of the Vulnerable Software and Affected Versions: SAP Cloud Connector affected versions not specified Description: A missing authorization check in SAP Cloud Connector allows an attacker on an adjacent network with low privileges to send a crafted request to the endpoint responsible for...

CVE-2025-27707: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for IntelR TiberTM Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access...

CVE-2025-49751: Missing Synchronization

Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network...

CVE-2025-8654

Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific fla...

CVE-2025-8654 Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability

Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific fla...

CVE-2025-8653 Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability

Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR. Authentication is not required to exploit this vulnerability. The specific...

CVE-2025-8654: Improper Neutralization of Special Elements used in an OS Command

Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR devices. Authentication is not required to exploit this vulnerability. The specific fla...

CVE-2025-8653: Stack-based Buffer Overflow

Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Kenwood DMX958XR. Authentication is not required to exploit this vulnerability. The specific...

CVE-2025-27211: Improper Input Validation

An Improper Input Validation in EdgeMAX EdgeSwitch Version 1.10.4 and earlier could allow a Command Injection by a malicious actor with access to EdgeSwitch adjacent network...

CVE-2025-8476

CVE-2025-8476 concerns Alpine iLX-507 devices, where the TIDAL streaming app suffers from improper certificate validation. The flaw allows a network-adjacent attacker to execute arbitrary code with root privileges, with authentication not required. The issue is documented across multiple sources ...

CVE-2025-8480: Improper Limitation of a Pathname to a Restricted Directory

Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Tidal music...

CVE-2025-8476: Improper Certificate Validation

Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

(0Day) (Pwn2Own) Alpine iLX-507 Command Injection Remote Code Execution

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Tidal music streaming application. The issue results from the lack ...

CVE-2025-8475: Stack-based Buffer Overflow

Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-507 devices. User interaction is required to exploit this vulnerability in that the target...

(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of proper...

(Pwn2Own) QNAP TS-464 Active Directory Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Active Directory integration. The issue results from the improper...

(Pwn2Own) QNAP TS-464 reset_password.cgi Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the use of a hard-coded...

(Pwn2Own) QNAP QHora-322 tar Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP QHora-322 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of parameters provided to the tar executable. The issue...