PT-2025-11: Server-Side Request Forgery (SSRF) in HTML2PDF

During the analysis of the HTML2PDF library version 5.3.1, despite the existence of the defense mechanism that was implemented to validate source image paths, a vulnerability allowing SSRF execution was found. The application performs insufficient validation of the destination address before...

linkatomic.com Cross Site Scripting vulnerability OBB-4048293

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2025-35: Local Privilege Escalation (LPE) in Tunnelblick

The vulnerability was identified in Tunnelblick, versions 3.5beta06 to 6.1beta2. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 22.04.2025 Recommendations: Update to...

PT-2025-08: Deserialization of untrusted data in TCPDF

This library has a class containing a POP Property Oriented Programming chain. When deserializing this class with certain values ​​of some fields, an attacker can delete an arbitrary file from the system. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.04.2025...

CVE-2025-28228

creationtimestamp| type| source ---|---|--- 2025-04-18 14:58:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12452 2025-04-29 13:27:11+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-28228.yaml 2025-05-01...

PT-2025-36: Local Privilege Escalation (LPE) in Amnezia VPN

The vulnerability was identified in Amnezia VPN, versions to 4.8.6.0, on MacOS. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 12.04.2025 Recommendations: Update to...

rollupdruck24.at Cross Site Scripting vulnerability OBB-4043446

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

flashtype.de Cross Site Scripting vulnerability OBB-4043035

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2025-18: Denial of Service (DoS) in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family

The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family , versions 231.1.162.1 package version, 1.10.3 hwrm spec. The discovered vulnerability is related to stack-based buffer overflow in the ChiMP core, which leads to...

CVE-2024-3300

creationtimestamp| type| source ---|---|--- 2025-04-08 15:02:26+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-3300.yaml...

CVE-2025-2075

creationtimestamp| type| source ---|---|--- 2025-04-04 04:35:20+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/10390 2025-04-04 07:48:28+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114278590519821899 2025-04-04 07:48:28+00:00| seen|...

wheelpros.com Cross Site Scripting vulnerability OBB-4042211

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

thearda.com Cross Site Scripting vulnerability OBB-4042190

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2025-07: Path Traversal in TCPDF

The vulnerability was identified in TCPDF, version 6.8.2. The application performs insufficient validation of user input data. Decoding user input allows an attacker to form a path to an arbitrary image on the server, access to which is not provided by the logic of the application, with subsequen...

CVE-2025-29085

creationtimestamp| type| source ---|---|--- 2025-04-02 23:01:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lluikug6tr2f 2025-04-03 01:01:39+00:00| seen| https://t.me/cvedetector/21930 2025-04-03 17:48:25+00:00| seen|...

STMicroelectronics X-CUBE-AZRTOS-F7 FileX Internal RAM interface buffer overflow vulnerability

Talos Vulnerability Report TALOS-2024-2096 STMicroelectronics X-CUBE-AZRTOS-F7 FileX Internal RAM interface buffer overflow vulnerability April 2, 2025 CVE Number CVE-2024-45064 SUMMARY A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics...

STMicroelectronics X-CUBE-AZRTOS-F7 HTTP server single PUT request integer underflow vulnerability

Talos Vulnerability Report TALOS-2024-2103 STMicroelectronics X-CUBE-AZRTOS-F7 HTTP server single PUT request integer underflow vulnerability April 2, 2025 CVE Number CVE-2024-50596,CVE-2024-50597 SUMMARY An integer underflow vulnerability exists in the HTTP server PUT request functionality of...

CVE-2025-31131

creationtimestamp| type| source ---|---|--- 2025-04-01 16:32:25+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/9944 2025-04-01 17:48:23+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114263962596198001 2025-04-01 17:48:23+00:00| seen|...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from ovsctsetlabels triggering a warning on a confirmed connection...

PT-2025-03: Local Privilege Escalation in Mobile Security Framework (MobSF)

The vulnerability was identified in Mobile Security Framework MobSF , versions 4.3.0. The discovered vulnerability allows an attacker with minimal privileges to obtain an API token, potentially resulting in privilege elevation within the system. Vulnerability status: Confirmed by vendor Date of...