Linux Distros Unpatched Vulnerability : CVE-2019-17009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a...

WordPress B Slider - Gutenberg Slider Block for WP plugin <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure vulnerability

WordPress B Slider - Gutenberg Slider Block for WP plugin = 2.0.0 - Authenticated Subscriber+ Sensitive Information Exposure vulnerability discovered by wesley wcraft in WordPress Plugin B Slider versions = 2.0.0...

CVE-2025-43983

CVE-2025-43983 affects KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices. The vulnerability set involves unauthenticated access to goform/goform_set_cmd_process and goform/goform_get_cmd_process, enabling an attacker to retrieve sensitive information (including the admin username/password), modify cri...

(Pwn2Own) Microsoft Windows Exposed Dangerous Function Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

PT-2025-33281 · Undefined · Undefined

KuWFi CPF908-CP5 WEB5.0 LCD 20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform set cmd process and goform/goform get cmd process. These allow an unauthenticated attacker to retrieve sensitive information including the device admin username and...

Russians hacked US courts, say investigators

Russia is after secret files in the US court system, according to reports this week—and its hackers appear to have reached at least some of them. Last week, news broke of a successful cyberattack against the decades-old US court filing system. Called Case Management/Electronic Case Files CM/ECF,...

CVE-2025-0818

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an...

CVE-2025-0818

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an...

CVE-2025-0818 Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion

Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an...

CVE-2025-3831 Exposed SFTP server

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties...

CVE-2025-3831 Exposed SFTP server

Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties...

CVE-2025-40751

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V3.3. Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credential...

CVE-2025-40752

A vulnerability has been identified in POWER METER SICAM Q100 7KG9501-0AA01-0AA1 All versions = V2.60 = V2.60 = V2.60 = V2.60 = V2.70 V2.80. Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configure...

CVE-2024-41984

CVE-2024-41984 affects SmartClient modules Opcenter QL Home, SOA Audit, and SOA Cockpit (SC) with versions 13.2–2505. The root cause is improper error handling when accessing an inaccessible resource, which can expose system applications. Affected products expose limited information due to error ...

Check Point Response to CVE-2025-3831 - Exposed SFTP server

Cause The agent used a shared SFTP key embedded in the software to upload diagnostic logs. The key was granted permission to read and list files on the server, rather than restricted to upload-only access. As a result, anyone possessing the key could access log files uploaded by other customers...

Brother Industries多款产品 安全漏洞

Brother Industries HL-L8360CDW and others are products of Brother Industries, Japan.Brother Industries HL-L8360CDW is a multifunction printer.Brother Industries HL-L8260CDN is a laser printer. The Brother Industries HL-L8260CDW is a laser printer. A security vulnerability exists in various Brothe...

Siemens SINEC Traffic Analyzer 信息泄露漏洞

Siemens SINEC Traffic Analyzer is a network traffic analysis tool from Siemens Germany. An information disclosure vulnerability exists in Siemens SINEC Traffic Analyzer versions prior to V3.0, which originates from an internal service port exposure that could lead to unauthorized access...

CVE-2025-8864

Shared Access Signature token is not masked in the backup configuration response and is also exposed in the ybbackup logs...

Linux Distros Unpatched Vulnerability : CVE-2016-3170

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The have you forgotten your password links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username...

The AuthKit Remix Library renders sensitive auth data in HTML

Summary Before 0.15.0, @workos-inc/authkit-remix returned sensitive authentication artifacts from the authkitLoader, specifically sealedSession and accessToken. Because these values were returned from the loader, they were embedded into the server-rendered HTML and became readable by any script...