EUVD-2024-0964

Malicious code in bioql PyPI...

CVE-2025-48728

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-59034 Indico may disclose unauthorized user details access via legacy API

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-58059

Valtimo is a platform for Business Process Automation. In versions before 12.16.0.RELEASE, and from 13.0.0.RELEASE to before 13.1.2.RELEASE, any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources. This includes but is not limited to:...

CVE-2025-30036

Stored XSS vulnerability exists in the "Oddział" Ward module, in the death diagnosis description field, and allows the execution of arbitrary JavaScript code. This can lead to session hijacking of other users and potentially to privilege escalation up to full administrative rights...

CVE-2025-30036

CVE-2025-30036 describes a stored XSS in the Oddział (Ward) module, within the death diagnosis description field. The flaw permits execution of arbitrary JavaScript, which can cause session hijacking of other users and potentially escalate privileges up to full admin rights. The provided metrics ...

CVE-2025-36729

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid...

CVE-2025-36729 RACOM M!DGE2 Privilege Escalation via SDK Testing Endpoint

A non-primary administrator user with admin rights to the web interface but without shell access permissions can display configuration of the device including the master admin password. This vulnerability also allows the user to give themselves shell access with the root gid...

CVE-2025-47870 Team invite ID leaked to team admin with no member invite privileges

Mattermost versions 10.8.x = 10.8.3, 10.5.x = 10.5.8, 9.11.x = 9.11.17, 10.9.x = 10.9.2 fail to sanitize the team invite ID in the POST /api/v4/teams/:teamId/restore endpoint which allows an team admin with no member invite privileges to get the team’s invite id...

CVE-2025-9137

CVE-2025-9137 affects Scada-LTS 2.7.8.1 and involves cross-site scripting via manipulation of the alias parameter in the scheduled_events.shtm file. The vulnerability is exploitable remotely; multiple sources describe an admin-permission requirement and note that an admin user can inject HTML/JS ...

WordPress Custom Comment plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan Patchstack Alliance in WordPress Plugin Custom Comment versions = 2.1.6...

CVE-2025-5941

Netskope is notified about a potential gap in its agent NS Client in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful...

CVE-2025-5941 Out-of-Bounds Read Vulnerability in Netskope Client

Netskope is notified about a potential gap in its agent NS Client in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful...

CVE-2025-5941 Out-of-Bounds Read Vulnerability in Netskope Client

Netskope is notified about a potential gap in its agent NS Client in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful...

CVE-2024-7402 Netskope Client Configuration Tampering with Local MITM

Netskope has identified a potential gap in its agent Netskope Client in which a malicious insider can potentially tamper the Netskope Client configuration by performing MITM Man-in-the-Middle activity on the Netskope Client communication channel. A successful exploitation would require...

Dell SupportAssist for Home PCs 安全漏洞

Dell SupportAssist for Home PCs is a client application for home computers from Dell USA that provides automated, proactive and predictive techniques for troubleshooting and more. An elevation of privilege vulnerability exists in Dell SupportAssist for Home PCs, which arises from improper privile...

CVE-2025-52970

Fortinet FortiWeb is affected by CVE-2025-52970 due to improper handling of parameters in FortiWeb versions 7.6.3 and below, 7.4.7 and below, 7.2.10 and below, and 7.0.10 and below. An unauthenticated remote attacker with non-public device information can gain admin privileges via a specially cra...

Linux Distros Unpatched Vulnerability : CVE-2023-32269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the Linux kernel before 6.1.11. In net/netrom/afnetrom.c, there is a use- after-free because accept is also allowed for a successfull...

CVE-2025-5450

Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated admin with read-only rights to modify settings that should be restricted...

CVE-2025-0293

CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights to write to a protected configuration file on disk...