CVE-2025-9997

CVE-2025-9997 relates to an OS command injection in BLMon Console (Schneider Electric) triggered during SSH sessions when running netstat. The root cause is improper neutralization of special elements in OS commands (CWE-78), potentially allowing execution of arbitrary shell commands on the affec...

CVE-2025-54239 After Effects | Out-of-bounds Read (CWE-125)

After Effects versions 25.3, 24.6.7 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure, potentially disclosing sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

CVE-2025-55053

CWE-328: Use of Weak Hash...

CVE-2025-55048

Multiple CWE-78...

CVE-2025-55054

CVE-2025-55054 is a CWE-79 Cross-site Scripting flaw: improper neutralization of input during web page generation leads to XSS. Connected data cites Baicells EG7035E-M11 (BaiCE_BM_2.5.26_NA) as affected, indicating a web-facing input handling weakness. The documents do not provide explicit exploi...

CVE-2025-55050

CWE-1242: Inclusion of Undocumented Features...

CVE-2025-53800

No cwe for this issue in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2025-55050: Inclusion of Undocumented Features or Chicken Bits

CWE-1242: Inclusion of Undocumented Features...

CVE-2025-55049: Use of Default Cryptographic Key

Use of Default Cryptographic Key CWE-1394...

Security Bulletin: IBM QRadar App SDK for IBM QRadar SIEM includes components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM has addressed the vulnerabilities. This product is only used by IBM QRadar SIEM app developers and external business partners and is not relevant for users o...

OESA-2025-2198 ImageMagick security update

Use ImageMagick to create, edit, compose, or convert bitmap images. It can read and write images in a variety of formats over 200 including PNG, JPEG, GIF, HEIC, TIFF, DPX, EXR, WebP, Postscript, PDF, and SVG. Use ImageMagick to resize, flip, mirror, rotate, distort, shear and transform images,...

CVE-2025-56608

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in OkHttpClientWrapper.java. The handleDigest function employs MessageDigest.getInstance"MD5" to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions...

NULL Pointer Dereference in mruby/mruby

...

CVE-2025-56608

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in OkHttpClientWrapper.java. The handleDigest function employs MessageDigest.getInstance"MD5" to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions...

OESA-2025-2076 mod_http2 security update

The modh2 Apache httpd module implements the HTTP2 protocol h2+h2c on top of libnghttp2 for httpd 2.4 servers. Security Fixes: A vulnerability classified as problematic has been found in Apache HTTP Server up to 2.4.63 Web Server.CWE is classifying the issue as CWE-617. The product contains an...

CVE-2025-52037: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the title of the service descriptions leads to a stored XSS vulnerability. The issue was confirmed to be present in the source code as of...

CVE-2025-8448: Exposure of Sensitive Information to an Unauthorized Actor

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products...

Tenda AC6 V5.0 /goform/getproductInfo information disclosure vulnerability

Talos Vulnerability Report TALOS-2025-2164 Tenda AC6 V5.0 /goform/getproductInfo information disclosure vulnerability August 20, 2025 CVE Number CVE-2025-24496 SUMMARY An information disclosure vulnerability exists in the /goform/getproductInfo functionality of Tenda AC6 V5.0 V02.03.01.110...

VerilogLAVD: LLM-Aided Rule Generation for Vulnerability Detection in Verilog

Timely detection of hardware vulnerabilities during the early design stage is critical for reducing remediation costs. Existing early detection techniques often require specialized security expertise, limiting their usability. Recent efforts have explored the use of large language models LLMs for...

CVE-2025-9043

The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as classified under CWE-428: Unquoted Search Path or Element. An attacker with write permissions to the root could place a malicious...