CVE-2025-21574

...

CVE-2025-21573

...

CVE-2025-32778 Web-Check allows command Injection via Unvalidated URL in Screenshot API

Web-Check is an all-in-one OSINT tool for analyzing any website. A command injection vulnerability exists in the screenshot API of the Web Check project Lissy93/web-check. The issue stems from user-controlled input url being passed unsanitized into a shell command using exec, allowing attackers t...

CVE-2025-31949

Growatt Cloud Applications (Growatt Cloud portal) is affected by CVE-2025-31949. An authenticated attacker can obtain arbitrary plant names by supplying a plant ID, indicating an access/validation weakness in the plant-name retrieval mechanism. Public details confirm vulnerable versions include 3...

CVE-2025-31933 Growatt Cloud Applications Authorization Bypass Through User-Controlled Key

An unauthenticated attacker can check the existence of usernames in the system by querying an API...

CVE-2025-33026

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-28136

creationtimestamp| type| source ---|---|--- 2025-04-15 16:38:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmujatgh4m2g 2025-04-15 17:26:32+00:00| seen| https://t.me/cvedetector/22953...

CVE-2025-24949

creationtimestamp| type| source ---|---|--- 2025-04-15 15:54:54+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11858 2025-04-15 18:43:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmuqak72xv2j 2025-04-15 19:57:03+00:00| seen| https://t.me/cvedetector/22965...

CVE-2025-3523

When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering over any attachment. Although the correct link is used on click, the misleading hover text could trick users into downloading content from...

CVE-2025-31945

creationtimestamp| type| source ---|---|--- 2025-04-15 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-105-04 2025-04-15 22:44:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmv5o2sh272h 2025-04-16 01:48:53+00:00| seen| https://t.me/cvedetector/2302...

CVE-2025-32993

Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password aka index.php?/home/forgot-password visusername parameter. Authentication is not needed...

CVE-2025-24358

gorilla/csrf provides Cross Site Request Forgery CSRF prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes...

CVE-2024-49200

An issue was discovered in AcpiS3SaveDxe and ChipsetSvcDxe in Insyde InsydeH2O with kernel 5.2 though 5.7. A potential DXE memory corruption vulnerability has been identified. The root cause is use of a pointer originating from the value of an NVRAM variable as the target of a write operation. Th...

CVE-2025-32996

In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used...

CVE-2025-28136

TOTOLINK A800R (firmware V4.1.2cu.5137_B20200730) contains a buffer overflow in the downloadFile.cgi component. The issue arises from improper validation of input data length in that CGI, with impact described as a buffer overflow (CVSS-ish context indicates Network access with low attack complex...

CVE-2025-29471

CVE-2025-29471 is a stored XSS in Nagios Log Server 2024R1.3.1 and earlier, exploitable via payloads in the Email field that can lead to privilege escalation (admin account creation) when an admin views audit logs. Public PoC/Exploits exist (e.g., ExploitDB, PoC video). Affected versions: 2024R1....

CVE-2025-33027

CVE-2025-33027 concerns Bandizip up to version 7.37 where a Mark-of-the-Web bypass exists in the handling of archived files. When extracting crafted archives bearing MoW, Bandizip fails to propagate the marker to extracted files, potentially allowing arbitrary code execution in the current user c...

CVE-2025-33026

In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of PeaZip. User interaction is required to exploit this vulnerability in that the target must visit a malicio...

CVE-2025-31494 AutoGPT allows cross-user sharing of node execution results through WebSockets API

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. The AutoGPT Platform's WebSocket API transmitted node execution updates to subscribers based on the graphid+graphversion. Additionally, there was no che...

CVE-2022-43840

creationtimestamp| type| source ---|---|--- 2025-04-14 20:54:32+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/11699 2025-04-14 22:38:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmsmvtzoj62i 2025-04-15 01:32:48+00:00| seen| https://t.me/cvedetector/22894...