CVE-2025-54571

A flaw was found in modsecurity. The engine may allow attackers to manipulate the HTTP response’s Content-Type header, enabling them to influence downstream processes or applications. This manipulation can be achieved remotely without authentication. Consequently, an attacker can alter the expect...

CVE-2025-45512

A flaw was found in the bootloader component of DENX Software Engineering Das U-Boot U-Boot. This vulnerability allows arbitrary code execution via installation of crafted firmware files due to missing signature verification. Mitigation Mitigation for this issue is either not available or the...

CVE-2025-54801

A flaw was found in github.com/gofiber/fiber/v2. The Ctx.BodyParser function fails to properly validate numeric form keys, allowing a large integer value to be interpreted as a slice index. This flaw allows a remote attacker to trigger this condition by submitting a crafted form with a sufficient...

CISA Adds 3 D-Link Vulnerabilities to KEV Catalog Amid Active Exploitation Evidence

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added three old security flaws impacting D-Link Wi-Fi cameras and video recorders to its Known Exploited Vulnerabilities KEV catalog, based on evidence of active exploitation in the wild. The high-severity vulnerabilities,...

Linux Distros Unpatched Vulnerability : CVE-2024-43897

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: net: drop bad gso csumstart and offset in virtionethdr Tighten csumstart and csumoffset...

CVE-2024-13978

A flaw was found in libtiff. The t2preadtiffinit function in the fax2ps component incorrectly handles TIFF files, leading to a null pointer dereference. A local attacker can trigger this condition by providing a specially crafted TIFF file. This can result in an application level denial of servic...

CVE-2025-54874

An out-of-bounds heap memory write OOB flaw was found in OpenJPEG. A call to opjjp2readheader may lead to an OOB heap memory write when the data stream pstream is too short and pimage is not initialized. Mitigation Mitigation for this issue is either not available or the currently available optio...

CVE-2025-54804

A flaw was found in russh. The SSH channel window adjust message processing incorrectly handles input, leading to an integer overflow. A remote attacker can trigger this overflow by sending a maliciously crafted SSH channel window adjust message. This integer overflow can result in an application...

CVE-2025-54119

A flaw was found in php-adodb. Improper escaping of query parameters allows an attacker to execute arbitrary SQL statements. A remote attacker can leverage this vulnerability by crafting a malicious query. This issue can lead to unauthorized data access or modification. Mitigation Mitigation for...

CVE-2025-48074

A memory exhaustion flaw has been discovered in OpenEXR. In affected versions, applications trust unvalidated dataWindow size values from file headers, which can lead to excessive memory allocation and performance degradation when processing malicious files. Mitigation Mitigation for this issue i...

CVE-2025-27212

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro Version 2.14.21 and earlier UniFi Access G2 Reader Pro Version 1.10.32 and earlier UniFi...

CVE-2025-27212

An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management network. Affected Products: UniFi Access Reader Pro Version 2.14.21 and earlier UniFi Access G2 Reader Pro Version 1.10.32 and earlier UniFi...

CVE-2025-27212

CVE-2025-27212 describes an improper input validation in multiple UniFi Access devices that could allow a malicious actor with access to the UniFi Access management network to perform a command injection, resulting in remote code execution. Affected products and versions include: UniFi Access Rea...

js-toml Prototype Pollution Vulnerability

A prototype pollution vulnerability in js-toml allows a remote attacker to add or modify properties of the global Object.prototype by parsing a maliciously crafted TOML input. Impact The js-toml library is vulnerable to Prototype Pollution. When parsing a TOML string containing the specially...

Claude Code echo command allowed bypass of user approval prompt for command execution

Due to an error in command parsing, it was possible to bypass the Claude Code confirmation prompt to trigger execution of an untrusted command. Reliably exploiting this requires the ability to add untrusted content into a Claude Code context window. Users on standard Claude Code auto-update...

CVE-2025-8341

A flaw was found in github.com/grafana/grafana-infinity-datasource. The Infinity datasource plugin incorrectly handles configuration when restricted to certain data sources, allowing an attacker to potentially trigger an out-of-bounds read. This vulnerability allows a remote attacker to manipulat...

CVE-2025-54349

A flaw was found in iperf3. An off-by-one error in the iperfauth.c file leads to a heap-based buffer overflow, potentially allowing a network attacker to trigger an application-level denial of service. This overflow occurs during the processing of authentication data. The vulnerability can only b...

CVE-2025-6004

A flaw was found in github.com/hashicorp/vault. The user lockout feature for Userpass and LDAP authentication methods can be bypassed, allowing an attacker to circumvent account lockout restrictions. This circumvention occurs without requiring prior authentication or knowledge of user credentials...

CVE-2025-6014

A flaw was found in github.com/hashicorp/vault. The Time-based One-Time Password Secrets Engine's TOTP validation endpoint allows code reuse during its validity period, enabling a remote attacker to potentially leverage existing, valid TOTP secrets. This vulnerability allows an attacker to...

CVE-2025-53399

In Sipwise rtpengine before 13.4.1.1, an origin-validation error in the endpoint-learning logic of the media-relay core allows remote attackers to inject or intercept RTP/SRTP media streams via RTP packets except when the relay is configured for strict source and learning disabled. Version 13.4.1...