EUVD-2025-22718

Malicious code in bioql PyPI...

CVE-2025-54831

Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively applying a "write-only" model for sensitive values. In Airflow 3.0.3, this model was...

GoCD Unauthenticated Access

GoCD is an open-source continuous delivery server. When accessible without authentication, an attacker can gain unauthorized access to the GoCD interface, potentially leading to information disclosure or further exploitation of the system. No source data...

CVE-2025-59363

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

PT-2025-37063

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in the management interface access control list ACL processing feature could allow an unauthenticated, remote attacker to bypass configured ACLs for the SSH,...

CVE-2025-55739

api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© PBX. In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17.0.1 and 17.0.2, there is an identical OAuth private key used across multiple systems that installed the same FreePBX RPM or DEB package. An...

CVE-2025-9696

The SunPower PVS6's BluetoothLE interface is vulnerable due to its use of hardcoded encryption parameters and publicly accessible protocol details. An attacker within Bluetooth range could exploit this vulnerability to gain full access to the device's servicing interface. This access allows the...

CVE-2024-50645

MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. An attacker can exploit this vulnerability to access API without any token...

CVE-2024-50641

An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. An attacker can exploit this vulnerability to access API without any token...

Vulnerabilities fixed in Commvault

Commvault has fixed vulnerabilities in Commvault components such as CommCell and ComServe versions prior to 11.36.60. The vulnerabilities are in versions of Commvault prior to 11.36.60. The first vulnerability allows unauthenticated attackers to execute API calls through a known login mechanism,...

PT-2025-34068 · Jobx · Jobx

Name of the Vulnerable Software and Affected Versions: jobx versions up to 1.0.1-RELEASE Description: An authentication bypass issue exists in jobx up to version 1.0.1-RELEASE. An attacker can exploit this issue to access sensitive API endpoints without any token through the preHandle function...

Linux Distros Unpatched Vulnerability : CVE-2024-20919

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions...

Exploit for CVE-2025-8730

CVE-2025-8730 – Authentication Bypass in Belkin F9K1009/F9K10...

CVE-2025-41425

DuraComm SPM-500 DP-10iN-100-MU is vulnerable to a cross-site scripting attack. This could allow an attacker to prevent legitimate users from accessing the web interface...

CVE-2025-34115

An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmdstr' parameter in the commandtest.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web...

CVE-2025-7213

CVE-2025-7213 concerns FNKvision FNK-GU2 devices (firmware versions up to 40.1.7) with an on‑chip debug/test interface exposed via the UART Interface. The root cause is improper access control of the UART interface, enabling unauthorized access to the on‑chip debug/test functionality. Impact is d...

CVE-2025-41224

A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X All versions V5.10.0, RUGGEDCOM RMC8388NC V5.X All versions V5.10.0, RUGGEDCOM RS416NCv2 V5.X All versions V5.10.0, RUGGEDCOM RS416PNCv2 V5.X All versions V5.10.0, RUGGEDCOM RS416Pv2 V5.X All versions V5.10.0, RUGGEDCOM RS416v2 V5.X Al...

PT-2025-28403 · Siemens · Ruggedcom Rsg910C +17

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RMC8388 versions prior to V5.10.0 RUGGEDCOM RMC8388NC versions prior to V5.10.0 RUGGEDCOM RS416NCv2 versions prior to V5.10.0 RUGGEDCOM RS416PNCv2 versions prior to V5.10.0 RUGGEDCOM RS416Pv2 versions prior to V5.10.0 RUGGEDCOM...

CVE-2025-30184 CyberData 011209 SIP Emergency Intercom Authentication Bypass Using an Alternate Path or Channel

CyberData 011209 Intercom could allow an unauthenticated user access to the Web Interface through an alternate path...

CVE-2025-30184

Summary (CVE-2025-30184) CyberData 011209 Intercom is vulnerable to an unauthenticated access to the Web Interface via an alternate path. Public disclosures across NVD, Red Hat, CNNVD, CVE list, and PT Security confirm an authentication bypass/vector against the Intercom’s web interface, with CVS...