Exploit for Code Injection in Xwiki

CVE-2025-24893 - XWiki Remote Code Execution RCE An updated...

CVE-2025-54575

ImageSharp is a 2D graphics library. In versions below 2.1.11 and 3.0.0 through 3.1.10, a specially crafted GIF file containing a malformed comment extension block with a missing block terminator can cause the ImageSharp GIF decoder to enter an infinite loop while attempting to skip the block. Th...

ASB-A-383131643

In multiple locations, there is a possible way to use apps linked from a context menu of a lockscreen app due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Debian: Security Advisory (DLA-4261-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: IBM Observability with Instana is vulnerable to Path Traversal in python

Summary python is used by IBM Instana Observability as part of the instana-agent CVE-2025-4517. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2025-4517 DESCRIPTION: Allows arbitrary filesystem writes outside the extraction directory durin...

Ubuntu: Security Advisory (USN-7684-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-31494 · Apache Jspwiki +1 · Image Plugin +1

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.12.3 Description: A carefully crafted request using the Image plugin could trigger a cross-site scripting XSS issue on Apache JSPWiki. This could allow an attacker to execute JavaScript in the victim's brows...

CVE-2025-54585

GitProxy (versions ≤ 1.19.1) is vulnerable to a new-branch approval exploit: nearby commits on a parent branch can be pushed without proper approval due to how new branches are detected (uses a zero-hash check). The issue requires only regular push access and no extra user interaction, but it doe...

RockyLinux 8 : rsync (RLSA-2025:8395)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:8395 advisory. zlib: Out-of-bounds pointer arithmetic in inftrees.c CVE-2016-9840 Tenable has extracted the preceding description block directly from the RockyLinux security...

PT-2025-31299 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.6 Description: Processing a maliciously crafted image may result in disclosure of process memory. This issue was addressed with improved checks. Recommendations: Update to macOS version 15.6...

Debian: Security Advisory (DSA-5967-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress WPML Multilingual CMS Plugin < 4.6.13 RCE Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpml:wpml"; if description...

WordPress KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Theme <= 4.21.0 is vulnerable to Arbitrary File Deletion

Software KALLYAS - Creative eCommerce Multi-Purpose WordPress Theme Type Theme Vulnerable versions = 4.21.0 Fixed in 4.22.0 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2025-6989 Patch priority Medium CVSS severity Medium 8.1 Developer EPC PSID fbbebe81e3b7 Credits...

Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competition

Recent advances have enabled LLM-powered AI agents to autonomously execute complex tasks by combining language model reasoning with tools, memory, and web access. But can these systems be trusted to follow deployment policies in realistic environments, especially under attack? To investigate, we...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Imagemagick

Exploit tailored for HackTheBox Pilgrimage Automatic python...

CVE-2025-8177

CVE-2025-8177 affects LibTIFF up to 4.7.0. The issue is in the function setrow (tools/thumbnail.c) and leads to a buffer overflow. Local attack is required. The patch (e8c9d6c616b19438695fd829e58ae4fde5bfbc22) fixes this issue; affected deployments note the maintainer has dropped support for some...

PT-2025-30973 · Campcodes · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Courier Management System version 1.0 Description: A critical issue exists in Campcodes Courier Management System version 1.0 due to a SQL injection vulnerability. The vulnerability is located in an unknown functionality of the /edi...

OESA-2025-1878 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: bpf: consider that tail calls invalidate packet pointers Tail-called programs could execute any of the helpers that invalidate packet pointers. Hence,...

Cisco Unified Intelligence Center Arbitrary File Upload (cisco-sa-cuis-file-upload-UhNEtStm)

The version of Cisco Unified Intelligence Center installed on the remote host is prior to tested version. It is, therefore, affected by an arbitrary file upload vulnerability as referenced in the cisco-sa-cuis-file-upload-UhNEtStm advisory: - A vulnerability in the web-based management interface ...

NewStart CGSL MAIN 7.02 : cups-filters Vulnerability (NS-SA-2025-0163)

The remote NewStart CGSL host, running version MAIN 7.02, has cups-filters packages installed that are affected by a vulnerability: - cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the...