CVE-2025-65289

A stored Cross site scripting XSS vulnerability in the Mercury MR816v2 081C3114 4.8.7 Build 110427 Rel 36550n router allows a remote attacker on the LAN to inject JavaScript into the router's management UI by submitting a malicious hostname. The injected script is stored and later executed in the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a post-release reuse issue in ipmidestroyuser...

TOTOLINK's X5000R's (AX1800 router) lacks authentication for telnet

Overview An unauthenticated HTTP request can enable telnet which may lead to remote code execution with root-level privileges. Description TOTOLINK manufactures routers and other networking equipment designed for small businesses and home implementations. The AX1800 routers are popular with users...

CVE-2025-64499

The CVE-2025-64499 entry concerns Tuleap: Community Edition versions prior to 17.0.99.1762456922 and Enterprise Edition versions prior to 17.0-2, 16.13-7, and 16.12-10 are vulnerable to CSRF in the Planning Management API, allowing attackers to create, edit, or remove plans. The root cause is CSR...

CVE-2025-65228

A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...

CVE-2025-65228

A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller firmware 1.5.1799...

Linux Distros Unpatched Vulnerability : CVE-2025-40226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - firmware: armscmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the...

R.V.R. Elettronica TLK302T 安全漏洞

The R.V.R. Elettronica TLK302T is a telemetry control system from R.V.R. Elettronica, Italy. A security vulnerability exists in the R.V.R. Elettronica TLK302T that originates from the presence of stored cross-site scripting in the web management interface...

Enalean Tuleap 跨站请求伪造漏洞

Enalean Tuleap is a free and open source tool from the French company Enalean. It is used for end-to-end traceability of application and system development. A cross-site request forgery vulnerability exists in Enalean Tuleap, which stems from the lack of CSRF protection in the Planning Management...

PT-2025-49595

Name of the Vulnerable Software and Affected Versions R.V.R. Elettronica TLK302T telemetry controller version 1.5.1799 Description A stored cross-site scripting issue exists in the web management interface. This allows for the injection of malicious scripts that can be executed in the context of...

CVE-2025-1545

An XPath Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensitive information from the Firebox configuration through an exposed authentication or management web interface. This vulnerability only affects Firebox systems that have at least...

CVE-2025-40226

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the...

CVE-2025-6946

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

CVE-2025-12195

CVE-2025-12195 describes an out-of-bounds write vulnerability in the WatchGuard Fireware OS CLI. An authenticated privileged user can trigger arbitrary code execution by sending specially crafted IPSec configuration CLI commands. Affected versions span Fireware OS 11.0–11.12.4+541730, 12.0–12.11....

CVE-2025-40226 firmware: arm_scmi: Account for failed debug initialization

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Account for failed debug initialization When the SCMI debug subsystem fails to initialize, the related debug root will be missing, and the underlying descriptor will be NULL. Handle this fault condition in the...

EUVD-2025-200298

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings...

CVE-2025-13510 Iskra iHUB and iHUB Lite has a Missing Authentication for Critical Function vulnerabilitiy

The Iskra iHUB and iHUB Lite smart metering gateway exposes its web management interface without requiring authentication, allowing unauthenticated users to access and modify critical device settings...

CVE-2025-13510

CVE-2025-13510 (Iskra iHUB / iHUB Lite) is a real vulnerability where the web management interface is exposed without authentication, allowing unauthenticated access to modify critical device settings. Affected product family: Iskra iHUB and iHUB Lite smart metering gateways. Root cause: missing ...

CVE-2025-20764

In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029...

CVE-2025-20764

CVE-2025-20764 affects the MediaTek “smi” component, where a missing bounds check allows an out-of-bounds write. This can enable local escalation of privilege for an attacker who already has System privileges, with no user interaction required. The issue is associated with patch ALPS10259774 (Iss...