CVE-2025-26391

CVE-2025-26391: SolarWinds Observability Self-Hosted exposes a cross-site scripting (XSS) vulnerability in user-created URL fields of the SolarWinds Platform. The issue requires authentication from a low-privilege account. Public exploitation details or concrete remediation are not provided in th...

CVE-2025-26391 SolarWinds Observability Self-Hosted XSS Vulnerability

SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account...

[SECURITY] Fedora 42 Update: fvwm3-1.1.4-1.fc42

Fvwm is a window manager for X11. It is designed to minimize memory consumption, provide a 3D look to window frames, and implement a virtual desktop...

CVE-2025-56499

VULNERABILITY: CVE-2025-56499 affects mihomo v1.19.11. Description: an access-control issue allows authenticated attackers with low privileges to read arbitrary files with elevated privileges by obtaining the external control key from the configuration file. Impact: elevated read access (confiden...

PT-2025-47292

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A low privileged remote attacker can upload any file to an arbitrary location due to a missing file check, potentially leading to remote code execution. The issue allows for unrestricted file uploads...

CVE-2025-63693

The comment editing template dzz/comment/template/editform.htm in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

CVE-2025-63693

CVE-2025-63693 affects DzzOffice 2.3.x. The vulnerability resides in the comment editing template (dzz/comment/template/edit_form.htm), which does not adequately escape user-controllable data across HTML and JavaScript contexts. This can allow low-privilege attackers to craft comment content or r...

PT-2025-47273

Name of the Vulnerable Software and Affected Versions SolarWinds Observability versions affected versions not specified Description The SolarWinds Platform is affected by a cross-site scripting XSS issue impacting user-created URL fields. Exploitation requires authentication from a low-level...

PT-2025-47390

Name of the Vulnerable Software and Affected Versions versions prior to 2025-37160 Description A broken access control BAC exists in the web-based management interface. An authenticated remote attacker with low privileges may be able to view sensitive information. Successful exploitation could le...

CVE-2025-56499

Incorrect access control in mihomo v1.19.11 allows authenticated attackers with low-level privileges to read arbitrary files with elevated privileges via obtaining the external control key from the config file...

SolarWinds Observability Self-Hosted 跨站脚本漏洞

SolarWinds Observability Self-Hosted is an observation platform from SolarWinds, Inc. A cross-site scripting vulnerability exists in SolarWinds Observability Self-Hosted, which stems from a cross-site scripting vulnerability in a user-created URL field that could lead to an attack by a...

PT-2025-47293

Name of the Vulnerable Software and Affected Versions versions prior to 2025 affected versions not specified Description A remote attacker with low privileges can upload or overwrite Python scripts. This is achieved through a path traversal of the target filename within a PHP context, leading to...

PT-2025-47325

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.4.0p16 Description A flaw exists in Checkmk where inadequate permission checks allow users with limited privileges to alter notification settings through the REST API. This could potentially result in unauthorized...

Collaborative research by Microsoft and NVIDIA on real-time immunity

AI-Powered Threats Demand AI-Powered Defense While AI supports growth and innovation, it is also reshaping how organizations address faster, more adaptive security risks. AI-driven security threats, including “vibe-hacking”, are evolving faster than traditional defenses can adapt. Attackers can n...

[SECURITY] Fedora 43 Update: fvwm3-1.1.4-1.fc43

Fvwm is a window manager for X11. It is designed to minimize memory consumption, provide a 3D look to window frames, and implement a virtual desktop...

WordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by daroo in WordPress Plugin Appointment Booking Calendar versions = 1.3.95...

WordPress Contest Gallery plugin <= 28.0.2 - Missing Authorization vulnerability

Missing Authorization vulnerability discovered by type5afe in WordPress Plugin Contest Gallery versions = 28.0.2...

WordPress Qi Blocks plugin <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize vulnerability

Missing Authorization to Arbitrary Attachment Resize vulnerability discovered by Adrian Lukita in WordPress Plugin Qi Blocks versions = 1.4.3...

CVE-2025-46368

Dell Alienware Command Center 6.x AWCC, versions prior to 6.10.15.0, contains an Insecure Temporary File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering...