GHSA-X3H8-62X9-952G Astro Development Server has Arbitrary Local File Read

Summary A vulnerability has been identified in the Astro framework's development server that allows arbitrary local file read access through the image optimization endpoint. The vulnerability affects Astro development environments and allows remote attackers to read any image file accessible to t...

PT-2025-47521

Name of the Vulnerable Software and Affected Versions FileCodeBox versions prior to 2.3 Description A path traversal issue exists in FileCodeBox that allows for arbitrary file writes. This occurs when the application is configured to use local filesystem storage. The SystemFileStorage.save file...

CVE-2025-63603

A command injection vulnerability exists in the MCP Data Science Server's reading-plus-ai/mcp-server-data-exploration 0.1.6 in the safeeval function src/mcpserverds/server.py:108. The function uses Python's exec to execute user-supplied scripts but fails to restrict the builtins dictionary in the...

Eurolab ELTS100_UBX 安全漏洞

The Eurolab ELTS100UBX is a network connectivity device from Eurolab Italy. A security vulnerability exists in the Eurolab ELTS100UBX ELTS100v1.UBX version, which stems from a lack of authentication of critical management endpoints and could lead to full device control...

CVE-2025-63603

A command injection vulnerability exists in the MCP Data Science Server's reading-plus-ai/mcp-server-data-exploration 0.1.6 in the safeeval function src/mcpserverds/server.py:108. The function uses Python's exec to execute user-supplied scripts but fails to restrict the builtins dictionary in the...

PT-2026-5661

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A stack-based buffer overflow vulnerability exists in libsoup during the parsing of multipart HTTP responses due to an incorrect length calculation. A remote attacker can exploit this by...

CVE-2025-64307

The set of connected sources confirms a concrete vulnerability in Brightpick products: the Internal Logic Control web interface allows unauthenticated access, enabling an unauthorized user to manipulate robot control functions (e.g., starting/stopping runners, assigning jobs, clearing stations, d...

CVE-2025-60684

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB V9.1.0u.6619B20230130 and NR1800X V9.1.0u.6681B20230703 Router firmware within the cstecgi.cgi binary sub42F32C function. The web interface reads the "lang" parameter and constructs Help URL strings using sprintf into fixed-siz...

CVE-2025-60688

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB V9.1.0u.6619B20230130 and NR1800X V9.1.0u.6681B20230703 Router firmware within the cstecgi.cgi binary setDefResponse function. The binary reads the "IpAddress" parameter from a web request and copies it into a fixed-size stack...

CVE-2025-60684

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB V9.1.0u.6619B20230130 and NR1800X V9.1.0u.6681B20230703 Router firmware within the cstecgi.cgi binary sub42F32C function. The web interface reads the "lang" parameter and constructs Help URL strings using sprintf into fixed-siz...

Apple macOS WindowServer Excessive Iteration Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Apple macOS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WindowServer component. The issue results from the lack of proper validati...

Generex UPS Adapter CS141 Unrestricted Upload of File with Dangerous Type (CVE-2022-47186)

There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the upload directory. This plugin only works with Tenable.ot. Please visit...

PT-2025-46848

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB V9.1.0u.6619 B20230130 and NR1800X V9.1.0u.6681 B20230703 Router firmware within the cstecgi.cgi binary setDefResponse function. The binary reads the "IpAddress" parameter from a web request and copies it into a fixed-size stac...

CVE-2025-60684

A stack buffer overflow vulnerability exists in the ToToLink LR1200GB V9.1.0u.6619B20230130 and NR1800X V9.1.0u.6681B20230703 Router firmware within the cstecgi.cgi binary sub42F32C function. The web interface reads the "lang" parameter and constructs Help URL strings using sprintf into fixed-siz...

EUVD-2025-131925

A vulnerability in FiberHome GPON ONU HG6145F1 RP4423 allows the device's factory default Wi-Fi password WPA/WPA2 pre-shared key to be predicted from the SSID. The device generates default passwords using a deterministic algorithm that derives the router passphrase from the SSID, enabling an...

CVE-2025-64323

kgateway’s xDS interface lacks authentication in affected versions (2.0.4 and earlier, and 2.1.0-agw-cel-rbac through 2.1.0-rc.2). An unauthenticated client with unrestricted network access can retrieve sensitive configuration data from the xDS port (certificate data, backend service information,...

CVE-2025-11546

The CVE-2025-11546 entry affects NEC CLUSTERPRO X for Linux (versions 4.0–5.2), EXPRESSCLUSTER X for Linux (4.0–5.2), CLUSTERPRO X SingleServerSafe for Linux (4.0–5.2), and EXPRESSCLUSTER X SingleServerSafe for Linux (4.0–5.2). The connected sources describe an OS command injection vulnerability ...

EUVD-2025-38189

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends...

CVE-2025-12488

oobabooga text-generation-webui trustremotecode Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this...

CVE-2025-12487 oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability

oobabooga text-generation-webui trustremotecode Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this...