CVE-2025-45607

An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request...

Improper Neutralization Of Escape, Meta, Or Control Sequences

Apache Tomcat is vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences. The vulnerability is due to certain uncommon rewrite rule configurations, specially crafted requests to bypass these rules, which allows an attacker to circumvent security constraints enforced by them...

CVE-2025-44860

TOTOLINK CA300-POE V6.2c.884B20180522 was found to contain a command injection vulnerability in the msgprocess function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2025-44864

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the module parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

Denial of Service (DoS)

Overview org.elasticsearch:elasticsearch is a Distributed, RESTful Search Engine. Affected versions of this package are vulnerable to Denial of Service DoS via specifically crafted search templates with Mustache functions. An attacker can cause the Elasticsearch node to crash by sending malicious...

CVE-2025-44866

CVE-2025-44866 affects the Tenda W20E router. A command injection exists in the formSetDebugCfg function via the level parameter, enabling arbitrary command execution through a crafted request. Affected software: Tenda W20E firmware version 15.11.0.6. Root cause: improper handling/filtering of sp...

Bosch Rexroth ctrlX OS 安全漏洞

Bosch Rexroth ctrlX OS is a Linux-based real-time operating system from Bosch Rexroth, an open control platform designed for industrial automation equipment. A security vulnerability exists in Bosch Rexroth ctrlX OS that originates from a specially crafted HTTP request in the network interface...

GHSA-FF77-26X5-69CR Apache Tomcat Rewrite rule bypass

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

DEBIAN-CVE-2025-31651

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

UBUNTU-CVE-2025-31651

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

undertow: unrestricted request storage leads to memory exhaustion

A flaw was found in Undertow package. Using the FormAuthenticationMechanism, a malicious user could trigger a Denial of Service by sending crafted requests, leading the server to an OutofMemory error, exhausting the server's memory...

CVE-2025-2492

An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially leading to unauthorized execution of functions. Refer to the 'ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information...

DEBIAN-CVE-2025-32906

A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server...

Langflow Remote Code Execution Vulnerability

Langflow is Langflow open source a visualization framework for building multi-agent and RAG applications . A remote code execution vulnerability exists in Langflow that can be exploited by an attacker to send a crafted HTTP request to execute arbitrary code...

The vulnerability of the NATS messaging system’s server lies in the lack of access control elements for the JetStream API. This allows attackers to delete data.

The vulnerability of the NATS messaging system server is related to the lack of access control elements for the JetStream API. Exploiting this vulnerability could allow a malicious actor to delete data by sending specially crafted requests...

The vulnerability of the Windows RRAS operating system’s routing and remote access services allows attackers to disclose sensitive information and execute arbitrary code.

The vulnerability of the Windows RRAS operating system’s routing and remote access service is related to reading data outside of the allowed range in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information and execute arbitrary code by sending a special...

The vulnerability in the web interface for managing Tenda FH1202 micro-program software routers allows a hacker to escalate their privileges.

The vulnerability of the web interface for managing Tenda FH1202 micro-programming software routers is related to deficiencies in access control when processing the /goform/qossetting endpoint. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially...

The vulnerability of the distribution and transaction optimization software in the Apache Seata microservice architecture, related to shortcomings in the deserialization mechanism, allows attackers to trigger service failures.

The vulnerability of distribution software and the improvement of transaction performance in the architecture of Apache Seata microservices is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to trigger service failures through a...

CVE-2025-25254

An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability CWE-22 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, 7.2 all versions, 7.0 all versions endpoint may allow an authenticated admin to access and modify the filesystem via crafted requests...

CVE-2024-46671

An Incorrect User Management vulnerability CWE-286 in FortiWeb version 7.6.2 and below, version 7.4.6 and below, version 7.2.10 and below, version 7.0.11 and below widgets dashboard may allow an authenticated attacker with at least read-only admin permission to perform operations on the dashboard...