EUVD-2025-204832

Hugging Face Transformers SEW convertconfig Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in that the targe...

EUVD-2025-204833

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability ...

CVE-2025-14388

creationtimestamp| type| source ---|---|--- 2025-12-23 10:03:44+00:00| seen| https://infosec.exchange/users/offseq/statuses/115768309982804801 2025-12-23 10:03:45+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3manioeubcv2z 2025-12-23 10:22:18+00:00| seen|...

CVE-2025-66209

creationtimestamp| type| source ---|---|--- 2025-12-23 09:00:05+00:00| seen| Telegram/rCQyUNwNINgTtycBx-WAU6uHir2-K9YryZ3eKw6czKX6mA 2025-12-23 21:56:31+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115771112901119412 2025-12-24 01:34:30+00:00| seen|...

From cheats to exploits: Webrat spreading via GitHub

In early 2025, security researchers uncovered a new malware family named Webrat. Initially, the Trojan targeted regular users by disguising itself as cheats for popular games like Rust, Counter-Strike, and Roblox, or as cracked software. In September, the attackers decided to widen their net:...

GHSA-4389-RWQF-Q9GQ

creationtimestamp| type| source ---|---|--- 2025-12-23 00:46:14+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115766117934771647 2025-12-24 08:03:28+00:00| seen| https://poliverso.org/objects/0477a01e-3e10999c-c8007be6f326122e 2026-01-06 03:55:17+00:00| seen|...

CVE-2025-68329

creationtimestamp| type| source ---|---|--- 2025-12-22 18:29:10+00:00| seen| https://infosec.exchange/users/vuldb/statuses/115764635225811156 2026-04-02 17:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0397/ 2026-04-07 18:00:00+00:00| seen|...

CVE-2025-14299

creationtimestamp| type| source ---|---|--- 2025-12-22 13:36:14+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115763483338124816 2026-01-08 20:17:03+00:00| published-proof-of-concept| Telegram/RkjRPVBdFl3Hoeg9hsolv65psYfRscti9PTfLQmu6kcQFxo...

CVE-2025-13329

creationtimestamp| type| source ---|---|--- 2025-12-20 04:04:32+00:00| seen| https://infosec.exchange/users/offseq/statuses/115749910664280235 2025-12-20 06:57:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mafmtpkrxo2q 2025-12-20 10:31:27+00:00| seen|...

CVE-2025-58085

creationtimestamp| type| source ---|---|--- 2025-12-19 16:30:11+00:00| seen| https://infosec.place/objects/d1296c3b-854f-4237-85fb-c696b20cdbb4...

CVE-2025-13307

creationtimestamp| type| source ---|---|--- 2025-12-19 07:05:59+00:00| seen| https://infosec.exchange/users/offseq/statuses/115744961823636580 2025-12-19 07:41:52+00:00| seen| https://gist.github.com/Darkcrai86/cd1792c2fd62567e2cd967ae4c56f9c8 2025-12-19 08:07:53+00:00| seen|...

EUVD-2025-204325

A stored cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Checkbox form component. This allows malicious scripts to execute in users' browsers by exploiting HTML support in the form builder...

EUVD-2025-204336

A cookie security configuration vulnerability in Kentico Xperience allows attackers to bypass SSL requirements when setting administration cookies via web.config. The vulnerability affects .NET Framework projects by incorrectly handling the 'requireSSL' attribute, potentially compromising session...

EUVD-2025-204377

A denial-of-service vulnerability exists in the omec-upf upf-epc-pfcpiface in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association Setup Request that is missing the mandatory Recovery Time Stamp Information Element, the association setup handler dereferences a nil pointer...

CVE-2025-14879

creationtimestamp| type| source ---|---|--- 2025-12-18 17:11:29+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115741680425989274 2025-12-18 20:18:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mabyp4w2el2e...

EUVD-2025-204386

A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler. This manipulation of the argument ssidindex causes stack-based buffer overflow. It is possible to initiate the attack remotely. The explo...

CVE-2025-65007

creationtimestamp| type| source ---|---|--- 2025-12-18 15:08:42+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115741197725003656...

GHSA-29CP-2HMH-HCXJ

creationtimestamp| type| source ---|---|--- 2025-12-18 14:32:17+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115741054476403924...

EUVD-2025-203971

The issue was addressed with additional permissions checks. This issue is fixed in macOS Tahoe 26.2, Safari 26.2. An app may be able to access sensitive user data...

EUVD-2025-203912

A Cross-site scripting XSS vulnerability in Create/Update Items Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...