CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

PT-2026-76601

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site WebSocket hijacking issue exists in the admin-only '/ws/network/proxy' endpoint. The flaw occurs because the CheckOrigin function is configured to unconditionally return true, effectively...

CVE-2025-32003

Out-of-bounds read in the firmware for some 100GbE IntelR Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring 0: Bare Metal OS may allow a denial of service. Network adversary with an authenticated user combined with a low complexity attack may enable denial of servic...

Progress Software Kemp LoadMaster delcert Command Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of user data passed to the delcert command. The iss...

CVE-2025-34238: Improper Limitation of a Pathname to a Restricted Directory

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web...

CVE-2025-52263: Download of Code Without Integrity Check

An issue in the Web Configuration module of Startcharge Artemis AC Charger 7-22 kW v1.0.4 allows authenticated network-adjacent attackers to upload crafted firmware, leading to arbitrary code execution...

EUVD-2025-33894

IBM Engineering Requirements Management Doors Next 7.0.2, 7.0.3, and 7.1 could allow an authenticated user on the network to delete reviews from other users due to client-side enforcement of server-side security...

CVE-2025-60010: Not Using Password Aging

A password aging vulnerability in the RADIUS client of Juniper Networks Junos OS and Junos OS Evolved allows an authenticated, network-based attacker to access the device without enforcing the required password change. Affected devices allow logins by users for whom the RADIUS server has responde...

EUVD-2024-54298

Malicious code in bioql PyPI...

CVE-2025-4876

ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations without dynamic key management. Once obtained t...

Zoom Workplace Apps for Windows Null Pointer Dereference Vulnerability

Zoom Workplace Apps for Windows is an official suite of collaboration tools from Zoom that includes core features such as team chat, whiteboards, notes, and more, and is required to be used through a Zoom Meetings account. A null pointer dereference vulnerability exists in Zoom Workplace Apps for...

CVE-2024-10210

CVE-2024-10210 affects the B&R APROL APROL Web Portal prior to version 4.4-005P. The vulnerability is an External Control of File Name or Path, allowing an authenticated network-based attacker to access data from the file system. The CVE entry lists a CVSS v4.0 base score of 8.4 (HIGH) with NETWO...

CVE-2024-10208 Cross Site Scripting vulnerability in APROL Web Portal

An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session...

CVE-2024-8314 Improper session handling in B&R APROL

An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL 4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials...

CVE-2024-10207: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL 4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs...

PT-2025-12734

Name of the Vulnerable Software and Affected Versions B&R APROL versions prior to 4.4-00P5 Description The issue is related to an incorrect implementation of the authentication algorithm and exposure of a data element to the wrong session in the session handling. This could allow an authenticated...

Oracle Siebel CRM (April 2012 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2012 CPU advisory. - Vulnerability in the Siebel Clinical component of Oracle Industry Applications subcomponent: Web UI. Supported versions that are affected are 7.7...

Oracle Siebel CRM (January 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2013 CPU advisory. - Vulnerability in the Siebel CRM component of Oracle Siebel CRM subcomponent: Siebel Calendar. Supported versions that are affected are 8.1.1 an...

Oracle Siebel CRM (April 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2013 CPU advisory. - Vulnerability in the Siebel Enterprise Application Integration component of Oracle Siebel CRM subcomponent: Web Services. Supported versions that...

Oracle Siebel CRM 8.1.1.x < 8.1.1.11 (October 2013 CPU)

The versions of Oracle Siebel CRM installed on the remote host are affected a vulnerability as referenced in the October 2013 CPU advisory. - Vulnerability in the Siebel Core - EAI component of Oracle Siebel CRM subcomponent: Web Services. The supported version that is affected is 8.1.1. Easily...