CVE-2025-57808 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's webserver authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correc...

CVE-2025-57808

ESPHome’s ESP-IDF web_server authentication check in version 2025.8.0 can bypass when the client-supplied Base64 Authorization value is empty or a substring of the correct value, allowing access to web_server functionality (including OTA if enabled) without valid credentials. This authentication ...

Linux Distros Unpatched Vulnerability : CVE-2018-18624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana 5.3.1 has XSS via a column style on the Dashboard Table Panel screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

PT-2025-35594

🟠 WhatsApp for iOS, Incomplete Authorization, CVE-2025-27890 Medium https://t.co/sEWb1FluxH...

Remote Code Execution (RCE)

Apache Commons OGNL is vulnerable to Remote Code Execution RCE. The vulnerability is due to incomplete blocklist restrictions in the OGNL engine when parsing and evaluating expressions, which allows an attacker to bypass protections and potentially achieve arbitrary code execution...

Linux Distros Unpatched Vulnerability : CVE-2025-43703

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Ankitects Anki through 25.02. A crafted shared deck can result in attacker- controlled access to the internal API even though the...

Linux Distros Unpatched Vulnerability : CVE-2022-30591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - quic-go through 0.27.0 allows remote attackers to cause a denial of service CPU consumption via a Slowloris variant in which incomplete QUIC or HTTP/3 requests...

Linux Distros Unpatched Vulnerability : CVE-2018-1051

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via Yaml.load in...

Linux Distros Unpatched Vulnerability : CVE-2022-29577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

CVE-2025-55177

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target’s device. We...

Security Bulletin: Incomplete Fix in Netty ≤ 4.1.118.Final Leads to DoS via Unsafe Environment File Handling on Windows, which affects IBM watsonx.data

Summary Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and including 4.1.118.Final. An unsafe reading of environment file could potentially cause a denial of service in Netty. When loaded on an Windows application, Netty attempts to load ...

CVE-2025-54995

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions...

Linux Distros Unpatched Vulnerability : CVE-2021-27379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of...

Linux Distros Unpatched Vulnerability : CVE-2024-7319

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command wit...

Debian dsa-5986 : node-cipher-base - security update

The remote Debian 12 / 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-5986 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5986-1 [email protected] https://www.debian.org/security/...

Linux Distros Unpatched Vulnerability : CVE-2016-9109

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Artifex Software MuJS allows attackers to cause a denial of service crash via vectors related to incomplete escape sequences. NOTE: this vulnerability exists du...

Linux Distros Unpatched Vulnerability : CVE-2015-1370

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incomplete blacklist vulnerability in marked 0.3.2 and earlier for Node.js allows remote attackers to conduct cross-site scripting XSS attacks via a vbscript ta...

Linux Distros Unpatched Vulnerability : CVE-2017-1000600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress version 4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to ...

Linux Distros Unpatched Vulnerability : CVE-2019-5062

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable denial-of-service vulnerability exists in the 802.11w security state handling for hostapd 2.6 connected clients with valid 802.11w sessions. By...