PT-2025-36933

Name of the Vulnerable Software and Affected Versions: IBM Jazz for Service Management versions 1.1.3.0 through 1.1.3.24 Description: IBM Jazz for Service Management does not set the secure attribute on authorization tokens or session cookies. This may allow attackers to obtain cookie values by...

Calix GigaCenter ONT Series 安全漏洞

The Calix GigaCenter ONT Series is a series of optical network terminals from Calix USA. A security vulnerability exists in the Calix GigaCenter ONT Series 844E version, 844G version, 844GE version, and 854GE version, which stems from the insecure storage of sensitive information and could lead t...

PT-2025-36952

Name of the Vulnerable Software and Affected Versions: TinyEnv versions 1.0.1 through 1.0.2 TinyEnv versions 1.0.9 through 1.0.10 Description: TinyEnv did not require the .env file to exist when loading environment variables. This could lead to unexpected behavior where the application silently...

CVE-2025-58757 MONAI's unsafe use of Pickle deserialization may lead to RCE

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, the pickleoperations function in monai/data/utils.py automatically handles dictionary key-value pairs ending with a specific suffix and deserializes them using pickle.loads . This...

CVE-2025-58756 MONAI's unsafe torch usage may lead to arbitrary code execution

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. In versions up to and including 1.5.0, in modeldict = torch.loadfullpath, maplocation=torch.devicedevice, weightsonly=True in monai/bundle/scripts.py , weightsonly=True is loaded securely. However, insecure loading method...

CVE-2025-52389

An Insecure Direct Object Reference IDOR in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other users via a crafted HTTP request...

GO-2025-3918 NeuVector admin account has insecure default password in github.com/neuvector/neuvector

NeuVector admin account has insecure default password in github.com/neuvector/neuvector. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

CVE-2025-41708

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41708 Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41708 Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission...

CVE-2025-41682

CVE-2025-41682 affects Bender GmbH & Co. KG charge controllers (e.g., CC612, CC613, ICC15xx). An authenticated, low-privileged attacker can access credentials stored on the device, including the manufacturer password, via insecure storage. Documents indicate this is a credential-disclosure vulner...

CVE-2025-41682 Credential Disclosure via Insecure Storage on Charge Controller

An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password...

CVE-2025-41682 Credential Disclosure via Insecure Storage on Charge Controller

An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password...

CVE-2025-58437

Coder allows organizations to provision remote development environments via Terraform. In versions 2.22.0 through 2.24.3, 2.25.0 and 2.25.1, Coder can be compromised through insecure session handling in prebuilt workspaces. Coder automatically generates a session token for a user when a workspace...

Google Android Information Disclosure Vulnerability (CNVD-2025-23028)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability caused by an insecure default value flaw in the generateRandomPasword function in LocalBluetoothLeBroadcast.java. An attacker can exploit the leak to obtai...

CVE-2025-52389

An Insecure Direct Object Reference IDOR in Envasadora H2O Eireli - Soda Cristal v40.20.4 allows authenticated attackers to access sensitive data for other users via a crafted HTTP request...

PT-2025-36532

Name of the Vulnerable Software and Affected Versions: MONAI versions up to and including 1.5.0 Description: MONAI is an AI toolkit for health care imaging. The software contains insecure model loading methods that can trigger a deserialization vulnerability, potentially leading to code execution...

SUSE: Security Advisory (SUSE-SU-2025:03087-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Bender多款产品 安全漏洞

Bender CC612 and others are products of Bender, Germany.Bender CC612 is a charge controller.Bender CC613 is a charge controller.Bender ICC15xx is an insulation monitoring device. A security vulnerability exists in several Bender products, which stems from an insecure default configuration that...

PT-2025-36445

Name of the Vulnerable Software and Affected Versions: Bender Charge Controller product families including CC612, CC613, ICC13xx, ICC15xx, ICC16xx Description: The web interface uses HTTP instead of HTTPS due to an insecure default configuration. An unauthenticated attacker on the same network...