PT-2025-39885

Name of the Vulnerable Software and Affected Versions Vasion Print versions prior to 25.1.102 Vasion Print Application versions prior to 25.1.1413 Description The /api-gateway/identity/search-groups API endpoint does not require authentication. An unauthenticated remote attacker can enumerate eve...

CVE-2020-36719

creationtimestamp| type| source ---|---|--- 2025-09-24 13:50:13+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-36719.yaml...

CVE-2020-36705

creationtimestamp| type| source ---|---|--- 2025-09-24 09:47:43+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/passive/cves/2020/CVE-2020-36705.yaml...

State-Sponsored Hackers Exploiting Libraesva Email Security Gateway Vulnerability

Libraesva has released a security update to address a vulnerability in its Email Security Gateway ESG solution that it said has been exploited by state-sponsored threat actors. The vulnerability, tracked as CVE-2025-59689 , carries a CVSS score of 6.1, indicating medium severity. "Libraesva ESG i...

CVE-2019-11886

creationtimestamp| type| source ---|---|--- 2025-09-18 01:43:53+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2019/CVE-2019-11886.yaml 2025-09-21 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lzes4jrnvf2g...

CVE-2025-2404 XSS in Ubit Information Technologies' STOYS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting XSS. This issue affects STOYS: from 2 before 20250916...

CVE-2020-11515

creationtimestamp| type| source ---|---|--- 2025-09-15 21:55:04+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-11515.yaml 2025-09-16 21:02:25+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lyy7rtlmvj2p...

PT-2025-86: Disclosure of confidential data via controller configuration request in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability can be exploited by an attacker to obtain administrator‑level privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2025-87: Incorrect session expiration in Fastwel PLC web server

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 CPM810-03, 3.4.9.1 СPM723-01. The discovered vulnerability can be exploited by an attacker to gain unlimited access to a device by brute-forcing or compromising a session token. Vulnerability status: Confirmed ...

CVE-2025-38724

CVE-2025-38724 affects the Linux kernel; nfsd4_setclientid_confirm() could race with an expiring confirmed client due to not checking get_client_locked() return value, risking a use-after-free. The fix applies to scenarios with an extant confirmed client by obtaining a reference earlier and handl...

CVE-2025-38724 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

In the Linux kernel, the following vulnerability has been resolved: nfsd: handle getclientlocked failure in nfsd4setclientidconfirm Lei Lu recently reported that nfsd4setclientidconfirm did not check the return value from getclientlocked. a SETCLIENTIDCONFIRM could race with a confirmed client...

PT-2025-92: Local Privilege Escalation in IDrive

The vulnerability was identified in IDrive, version 4.0.0.38. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 02.09.2025 Recommendations: Update to version MacVersion...

CVE-2025-50983

Readarr 0.4.15.2787 exposes a SQL Injection in the sortKey parameter of GET /api/v1/wanted/cutoff. The endpoint fails to sanitize user input, enabling arbitrary SQL execution against the backend SQLite DB. Exploitation was confirmed with sqlmap via stacked queries; a heavy query using SQLite RAND...

CVE-2023-1893

creationtimestamp| type| source ---|---|--- 2025-08-19 11:41:12+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-1893.yaml 2025-08-23 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lx3ulqp22b2z...

CVE-2020-36708

creationtimestamp| type| source ---|---|--- 2025-08-19 03:00:06+00:00| seen| Telegram/-Fva4EPYFaBqns2Cr0zCt3lPp7sYwzJV4LoxTKWmPvbqvA 2025-08-19 05:58:57+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-36708.yaml 2025-08-21 21:02:32+00:00|...

MAL-2025-8365 Malicious code in @lbnqduy1/upgraded-carnival (npm)

The package @lbnqduy1/upgraded-carnival was found to contain malicious code...

PT-2025-66: Arbitrary file write in Booco

The vulnerability was identified in Booco, version Server v2.38.3. The discovered vulnerability allows an attacker to supply a relative path in a parameter, which results in a new file being created or an existing file being overwritten in any directory of the file system. Vulnerability status:...

PT-2025-111: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to exploit incorrect authorization, obtaining information or functions beyond their privileges. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 08.08.2025...

PT-2025-109: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout , versions 1.8.182. The discovered vulnerability allows an attacker to bypass access‑control in the Custom Fields module, performing actions not permitted for their role. Vulnerability status: Confirmed by vendor Date of vulnerability remediation:...

PT-2025-108: Insufficient authorization in FreeScout

The vulnerability was identified in FreeScout, version 1.8.182. The discovered vulnerability allows an attacker to subvert access‑control verification in the Kanban module, obtaining unauthorized access to protected functionality. Vulnerability status: Confirmed by vendor Date of vulnerability...