104171 matches found
CVE-2025-59387 MARS (Multi-Application Recovery Service)
An SQL injection vulnerability has been reported to affect MARS Multi-Application Recovery Service. The remote attackers can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: MARS Multi-Application Recovery...
CVE-2025-9110 QTS, QuTS hero
An exposure of sensitive system information to an unauthorized control sphere vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the followin...
Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign
Cybersecurity researchers have disclosed details of a phishing campaign that involves the attackers impersonating legitimate Google-generated messages by abusing Google Cloud's Application Integration service to distribute emails. The activity, Check Point said, takes advantage of the trust...
OreaHax-Framework
OreaHax-Framework ╔════════════════════════════════════...
CVE-2025-15427
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The vendor mentioned in the original disclosure filed a report that this issue affects a different...
PT-2026-1102
Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.8.3332 build 20251128 QNAP versions prior to QuTS hero h5.2.8.3321 build 20251117 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description A flaw exists that allows unauthorized access to sensitive...
QNAP Systems HBS 3 Hybrid Backup Sync 安全漏洞
QNAP Systems HBS 3 Hybrid Backup Sync is a backup and synchronization tool from Taiwan, China-based QNAP Systems. A security vulnerability exists in QNAP Systems HBS 3 Hybrid Backup Sync that originates from the generation of an error message containing sensitive information that could result in...
QNAP Systems QuMagie 跨站脚本漏洞
QNAP Systems QuMagie is an AI Intelligent Photo Management software from QNAP Systems Taiwan, China. A cross-site scripting vulnerability exists in QNAP Systems QuMagie that originates in cross-site scripting and could lead to bypassing security mechanisms or reading application data...
QNAP Systems Multi-Application Recovery Service SQL注入漏洞
QNAP Systems Multi-Application Recovery Service is a multi-application disaster recovery solution from Taiwan, China-based QNAP Systems. A SQL injection vulnerability exists in QNAP Systems Multi-Application Recovery Service versions prior to 1.2.1.1686, which originates from an SQL injection tha...
CVE-2025-15373
A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be use...
PT-2026-25819
Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.2 Description Glances, a system cross-platform monitoring tool, had insufficient host validation in its main REST/WebUI FastAPI application prior to version 4.5.2. This allowed the REST API, WebUI, and token...
PT-2026-25938
CVE-2026-4359 A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver. https://t.co/CeMfkBeSoo...
CVE-2025-69286 RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability
RAGFlow is an open-source RAG Retrieval-Augmented Generation engine. In versions prior to 0.22.0, the use of an insecure key generation algorithm in the API key and beta assistant/agent share auth token generation process allows these tokens to be mutually derivable. Specifically, both tokens are...
Expanding the Zero Critical Club to set a new standard for AppSec and SecOps teams
We are introducing Zero Code Criticals and Zero Time to Respond clubs to give every team a clear north star for secure development and rapid response...
CVE-2025-13029 Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion
The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attackers to delete arbitrary users...
EUVD-2024-55371
Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized access to administrative functionalities...
CVE-2025-65925
An issue was discovered in Zeroheight SaaS prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the intended email verification step. While unverified accounts could not access product functionality, the behavior bypassed intended verification...
CVE-2025-15211
A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationalitynid can lead to sql injection. The attack can be executed remotely. The...
PT-2025-54271
A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be use...