CVE-2025-66002 Local users can perform arbitrary unmounts via smb4k mount helper due to lack of input validation

An Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper...

CVE-2025-66002

CVE-2025-66002 affects smb4k (KDE mount helper). Description: an improper neutralization of argument delimiters enables local users to perform arbitrary unmounts via the smb4k mount helper. Impact details in sources indicate local access, low privileges required, with potential high impact on ava...

CVE-2025-67918

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through = 5.4.30...

CVE-2025-67932 WordPress Listeo Core plugin < 2.0.19 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.This issue affects Listeo Core: from n/a through 2.0.19...

CVE-2019-25282

Summary of CVE-2019-25282 (V-SOL GPON/EPON OLT Platform) The issue is an open redirect vulnerability in the bindProfile.html script of V-SOL GPON/EPON OLT Platform, affecting versions 2.03 and 2.03.62R IPv6. The root cause is improper validation of the GET parameter named parent , allowing an att...

CVE-2025-20794

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patc...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000330 advisory. Improper input validation in BlueZ may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Tenable has extracted the...

PT-2026-1647

Name of the Vulnerable Software and Affected Versions Frenify Arlo versions through 6.0.3 Description A flaw exists in Frenify Arlo that allows for Reflected Cross-site Scripting XSS. This issue arises from improper input validation during web page generation. The vulnerability could potentially...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000448)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000448 advisory. Insufficient input validation in i40e driver for IntelR Ethernet 700 Series Controllers versions before 7.0 may allow an authenticated user to potentially enable a...

EUVD-2026-1154

iccDEV provides a set of libraries and tools for working with ICC color management profiles. Versions 2.3.1.1 and below have an Out-of-bounds Read, Use of Out-of-range Pointer Offset and have Improper Input Validation in its CIccProfile::LoadTag function. This issue is fixed in version 2.3.1.2...

CVE-2025-20796

In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: ALPS10314745; Issue ID: MSV-5553...

CVE-2025-20794

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patc...

PT-2026-1446

Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the 'pagina' GET parameter. Attackers can craft malicious links that redirect users to arbitrary websites by exploiting improper input...

The vulnerability of the Invite Request Handler component in the software for monitoring functionality and infrastructure of BlueWave Checkmate allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Invite Request Handler component in the software for monitoring functionality and infrastructure of BlueWave Checkmate is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...

EUVD-2025-205869

pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function...

PT-2025-54457

Name of the Vulnerable Software and Affected Versions PocketMine-MP versions prior to 4.18.1 Description PocketMine-MP versions prior to 4.18.1 have an issue with how input is checked when handling inventory transactions. A remote attacker who has a valid player session can ask the server to drop...

EUVD-2025-205640

Micro Registration Utility µURU is a telephone self registration utility based on asterisk. In versions up to and including commit 88db9a953f38a3026bcd6816d51c7f3b93c55893, an attacker can crafts a special federation name and characters treated special by asterisk can be injected into the Dial...

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Framelink Figma MCP Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the fetchWithRetry method. The issue results from the...

The vulnerability of the bpf_sock_addr() function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the bpfsockaddr function in the Linux operating system’s kernel is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-8769

Telenium Online Web Application is vulnerable due to a Perl script that is called to load the login page. Due to improper input validation, an attacker can inject arbitrary Perl code through a crafted HTTP request, leading to remote code execution on the server...