CVE-2025-6088

CVE-2025-6088 affects danny-avila/librechat. In version 0.7.8, improper authorization on the conversation sharing endpoint /api/share/conversationID allows a logged-in user to read other users’ conversations when the conversation ID is known. UUIDv4 IDs are server-side but can leak via logs, hist...

CVE-2025-6088 Improper Authorization in danny-avila/librechat

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they...

PT-2025-37183

In Content Management versions 20.4- 25.3 authenticated attackers may exploit a complex cache poisoning technique to download unprotected files from the server if the filenames are known...

@manniwatch/client-desktop (>=0.30.0, <=0.30.1), @manniwatch/client-ng (>=0.30.0, <=0.30.1) +2 more potentially affected by CVE-2025-59052 via @angular/ssr (>=19.0.5, <=19.2.1)

@angular/ssr NPM version =19.0.5, =0.30.0, =0.30.0, =19.0.0-alpha.20, =19.0.0-alpha.20, =19.0.0-alpha.24 Source cves: CVE-2025-59052 Source advisory: OSV:GHSA-68X2-MX4Q-78M7...

CVE-2025-36756

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known...

CVE-2025-58445

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. All versions of Atlantis publicly expose detailed version information through its /status endpoint. This information disclosure could allow attackers to identify and target known...

PT-2025-44127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel's coresight component related to the handling of return values from the devm kzalloc function. Specifically, the return value of devm kzalloc could be a...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-38352link is external Linux Kernel Time-of-Check Time-of-Use TOCTOU Race Condition Vulnerability CVE-2025-48543link is external Android Runtime Unspecifi...

CVE-2025-52549

E3 Site Supervisor Control firmware version 2.31F01 generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters...

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

...

Default mimetype known files writeable on Windows

...

CVE-2025-52549

E3 Site Supervisor Control firmware version 2.31F01 generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters...

CVE-2025-52549

E3 Site Supervisor Control firmware version 2.31F01 generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters...

CVE-2025-52549 Predictable root linux password generation

E3 Site Supervisor Control firmware version 2.31F01 generates the root linux password on each boot. An attacker can generate the root linux password for a vulnerable device based on known or easy to fetch parameters...

PT-2025-35560

Name of the Vulnerable Software and Affected Versions: E2 Facility Management Systems affected versions not specified Description: E2 Facility Management Systems utilizes a proprietary protocol that permits unauthenticated file operations on any file within the file system. Recommendations: At th...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-57819link is external Sangoma FreePBX Authentication Bypass Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors a...

@ainsleydev/payload-helper (>=0.0.3, <=0.0.32), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +15 more potentially affected by CVE-2025-4643 +1 more via payload (>=3.0.0-alpha.49, <=3.35.1)

payload NPM version =3.0.0-alpha.49, =0.0.3, =0.1.0, =1.0.0, =3.1.0-types, =1.0.0, =0.2.0, =3.1.1, =0.1.4, =1.0.0, =0.0.9-alpha.5, =1.0.0, =0.3.0-v3, =0.0.1, =1.0.0 and more Source cves: CVE-2025-4643, CVE-2025-4644 Source advisory: SNYK:JS-PAYLOAD-12239899...

PT-2025-44142

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw related to improper handling of device references, potentially leading to a use-after-free condition. Specifically, the issue arises from not correctly...

DRUPAL-CONTRIB-2025-101

This module enables you to protect individual pages with a password. The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks. This vulnerability is mitigated by the fact that an attacker must know the protected page's URL. CVSS risk score experimental...

Linux Distros Unpatched Vulnerability : CVE-2021-45111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to trigger the creation of...