CVE-2025-64169 Wazuh NULL pointer dereference in fim_alert line 666

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 3.7.0 to before 4.12.0, fimalert implementation does not check whether oldsum-md5 is NULL or not before dereferencing it. A compromised agent can cause a crash of analysisd by sending a...

CVE-2025-12983

GitLab CE/EE is affected by CVE-2025-12983 in all versions prior to 18.3.6 (18.4 prior to 18.4.4 and 18.5 prior to 18.5.2). An authenticated attacker could cause a denial-of-service by submitting specially crafted markdown with nested formatting patterns. Mitigation is to upgrade to GitLab to 18....

EUVD-2025-34456

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand...

EUVD-2025-27830

Malicious code in bioql PyPI...

CVE-2025-59304

A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted HTTP request...

Linux Distros Unpatched Vulnerability : CVE-2024-6747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information leakage in mknotifyd in Checkmk before 2.3.0p18, 2.2.0p36, 2.1.0p49 and in 2.0.0p39 EOL allows attacker to get potentially sensitive data...

Linux Distros Unpatched Vulnerability : CVE-2022-21719

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contai...

Linux Distros Unpatched Vulnerability : CVE-2022-39229

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's...

CVE-2025-57799 StreamVault can perform remote command execution

StreamVault is a multi-platform video parsing and downloading tool. Prior to version 250822, after logging into the StreamVault-system, an attacker can modify certain system parameters, construct malicious commands, execute command injection attacks against the system, and ultimately gain server...

Linux Distros Unpatched Vulnerability : CVE-2019-9175

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GitLab Community and Enterprise Edition before 11.6.10, 11.7.x before 11.7.6, and 11.8.x before 11.8.1. It allows Information Exposur...

Linux Distros Unpatched Vulnerability : CVE-2022-24778

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The imgcrypt library provides API exensions for containerd to support encrypted container images and implements the ctd-decoder command line tool for use by...

Linux Distros Unpatched Vulnerability : CVE-2025-49466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aerc before 93bec0d allows directory traversal in commands/msgview/open.go because of direct path concatenation of the name of an attachment part, CVE-2025-4946...

BIT-LIBPHP-2025-1736 Stream HTTP wrapper header check might omit basic auth header

In PHP from 8.1. before 8.1.32, from 8.2. before 8.2.28, from 8.3. before 8.3.19, from 8.4. before 8.4.5, when user-supplied headers are sent, the insufficient validation of the end-of-line characters may prevent certain headers from being sent or lead to certain headers be misinterpreted...

Linux Distros Unpatched Vulnerability : CVE-2024-32875

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.125.3, title arguments in Markdown for links and images not escaped in...

CVE-2025-32956

ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix namespace name, which is the current namespace you are renaming with an injection...

DEBIAN-CVE-2024-8929

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the same server...

PT-2024-35410 · Hkcms · Hkcms

Name of the Vulnerable Software and Affected Versions: HkCms versions prior to 2.3.2.240702 Description: The issue concerns a file upload vulnerability in the getFileName method located in /app/common/library/Upload.php. Recommendations: For versions prior to 2.3.2.240702, consider disabling the...

PT-2024-20939 · Bytecode Alliance · Wasm-Micro-Runtime

Name of the Vulnerable Software and Affected Versions: bytecodealliance wasm-micro-runtime versions before v.b3f728c Description: The issue allows a remote attacker to escalate privileges via a crafted file to the check was abi compatibility function. Recommendations: For versions before v.b3f728...

PT-2024-32085 · Inroad · Inroad

Name of the Vulnerable Software and Affected Versions: INROAD versions prior to v202402060 Description: The issue concerns the API endpoint "/AccountMaster/GetCurrentUserInfo" where attackers can access sensitive information by sending a crafted payload to the UserNameOrPhoneNumber parameter. Thi...

PT-2024-32996 · Ruijie · Ruijie Rg-Uac

Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC versions prior to 20240507 Description: A critical vulnerability exists in Ruijie RG-UAC. The manipulation of the name argument in an unknown function of the file /view/networkConfig/physicalInterface/interface commit.php leads ...