CVE-2025-30749

CVE-2025-30749 affects Oracle Java SE, GraalVM for JDK and GraalVM Enterprise Edition (component: 2D, with JSSE/Networking/Scripting as other components) per the provided documents. Affected Oracle Java SE versions include 8u451, 8u451-perf, 11.0.27, 17.0.15, 21.0.7, 24.0.1; affected GraalVM for ...

CVE-2025-30748

CVE-2025-30748 affects Oracle PeopleSoft PeopleTools (PIA Core Technology) in versions 8.60, 8.61, and 8.62. The vulnerability stems from the PIA Core Technology and can be exploited by an unauthenticated attacker with network access over HTTP; exploitation requires human interaction and may impa...

CVE-2025-30746

...

CVE-2025-30746

...

CVE-2025-30746

The CVE-2025-30746 entry concerns Oracle E-Business Suite’s Oracle iStore Shopping Cart (versions 12.2.3–12.2.14). The vulnerability allows an unauthenticated, network-accessible attacker over HTTP to compromise iStore, requiring user interaction. Impact includes unauthorized update/insert/delete...

CVE-2025-30744

...

CVE-2025-30739

...

CVE-2025-41239

creationtimestamp| type| source ---|---|--- 2025-07-15 18:53:54+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114858762801914674 2025-07-16 12:20:29+00:00| seen| https://vulnerability.circl.lu/bundle/419fd7d2-3c77-4032-b717-747015a7b289 2025-07-16 12:26:04+00:00| seen|...

CVE-2025-34113 Tiki Wiki CMS Authenticated Command Injection in Calendar Module

An authenticated command injection vulnerability exists in Tiki Wiki CMS versions ≤14.1, ≤12.4 LTS, ≤9.10 LTS, and ≤6.14 via the viewmode GET parameter in tiki-calendar.php. When the calendar module is enabled and an authenticated user has permission to access it, an attacker can inject and execu...

CVE-2025-34112

Riverbed SteelCentral NetProfiler / NetExpress 10.8.7 virtual appliances are affected by an authenticated multi‑stage remote code execution chain. A SQL injection in /api/common/1.0/login allows an attacker to create a new user, which is then used to trigger a command injection in /index.php?page...

CVE-2025-53891

creationtimestamp| type| source ---|---|--- 2025-07-15 06:33:43+00:00| seen| https://bsky.app/profile/potato.software/post/3ltybumgogk26...

CVE-2025-7360

CVE-2025-7360 (HT Contact Form Widget for Elementor / Gutenberg Blocks / Form Builder) The WordPress plugin versions up to 2.2.1 are vulnerable to an arbitrary file move due to insufficient file path validation in handle_files_upload(), allowing unauthenticated attackers to relocate files on the ...

CVE-2025-53027

creationtimestamp| type| source ---|---|--- 2025-07-15 03:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-25-602/...

FacialMotionID: Identifying Users of Mixed Reality Headsets Using Abstract Facial Motion Representations

Facial motion capture in mixed reality headsets enables real-time avatar animation, allowing users to convey non-verbal cues during virtual interactions. However, as facial motion data constitutes a behavioral biometric, its use raises novel privacy concerns. With mixed reality systems becoming...

CVE-2025-53825 Dokploy's Preview Deployments are vulnerable to Remote Code Execution

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to version 0.24.3, an unauthenticated preview deployment vulnerability in Dokploy allows any user to execute arbitrary code and access sensitive environment variables by simply opening a pull request on a public repository. This...

CVE-2025-53014

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions prior to 7.1.2-0 and 6.9.13-26 have a heap buffer overflow in the InterpretImageFilename function. The issue stems from an off-by-one error that causes out-of-bounds memory access when processi...

CVE-2025-24391

A vulnerability in the External Interface of OTRS allows conclusions to be drawn about the existence of user accounts through different HTTP response codes and messages. This enables an attacker to systematically identify valid email addresses. This issue affects: OTRS 7.0.X OTRS 8.0.X OTRS 2023....

CVE-2024-58258

creationtimestamp| type| source ---|---|--- 2025-07-14 08:13:13+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3ltvwxkubqw2i 2025-07-14 09:30:15+00:00| published-proof-of-concept| https://t.me/TopCyberTechNews/544 2025-07-14 10:09:32+00:00| seen|...

CVE-2025-7582 PHPGurukul Online Fire Reporting System assigned-requests.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/assigned-requests.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-25180 GPU DDK - Insufficient validation in RGXCREATEFREELIST creates corrupt freelist

Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver but memory pages in use by the kern...