CVE-2025-58484

Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox...

CVE-2025-12954 Timetable and Event Schedule by MotoPress < 2.4.16 - Contributor+ Event Disclosure via IDOR

The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event disclosure when to users with a role as low as Contributor...

CVE-2025-12954

The Timetable and Event Schedule by MotoPress WordPress plugin, in versions before 2.4.16 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify if a user has the necessary permissions to access a specific event during the duplication process. This f...

PT-2025-48817

Name of the Vulnerable Software and Affected Versions React Server Components versions 19.0.0 through 19.2.0 Description A pre-authentication remote code execution issue exists in the react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack packages. The problem stems fro...

VulnCheck KEV: CVE-2025-55182

Meta React Server Components contains a remote code execution vulnerability that could allow unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints. Please note CVE-2025-66478 has been rejected, but it is associated with...

PT-2026-64182

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 5.9.9 Description Unauthenticated remote code execution is possible because the software bundles a version of Next.js where React Server Components RSC request handling deserializes attacker-controlled input. A remote...

PT-2025-48983

Name of the Vulnerable Software and Affected Versions PgBouncer versions prior to 1.25.1 Description A flaw exists in PgBouncer’s authentication process due to an untrusted search path within the auth query connection handler. This allows an unauthenticated attacker to execute arbitrary SQL code...

PgBouncer 安全漏洞

PgBouncer is an open source lightweight connection pool for PostgreSql from the PgBouncer community. A security vulnerability exists in PgBouncer versions prior to 1.25.1, which stems from an untrusted search path in the authquery connection handler, and could allow an unauthorized attacker to...

Smallstep step-ca 安全漏洞

Smallstep step-ca is an online certificate authority for secure, automated certificate management for DevOps from Smallstep USA. A security vulnerability exists in Smallstep step-ca versions prior to 0.29.0 that stems from improper SSH certificate revocation authorization checking, which could le...

png -- Out-of-bounds read

https://github.com/pnggroup/libpng/security/advisories/GHSA-9mpm-9pxh-mg4f reports: Prior to 1.6.52, an out-of-bounds read vulnerability in libpng's simplified API allows reading up to 1012 bytes beyond the pngsRGBbase512 array when processing valid palette PNG images with partial transparency an...

Go Ldap Admin 安全漏洞

Go Ldap Admin is an openLDAP backend management project based on Go+Vue implementation organized by China opsre. A security vulnerability exists in Go Ldap Admin 20251011 and earlier versions, which originates from the use of hard-coded encryption keys by the JWT Handler component in the...

HCLTech DRAGON 安全漏洞

HCLTech DRAGON is a data retention / archiving / mass data storage and retrieval solution from HCL Corporation, USA. A security vulnerability exists in HCLTech DRAGON versions prior to 7.6.0 that stems from the API not enforcing a request number or size limit, which could lead to remote execution...

CVE-2025-66459

CVE-2025-66459 affects Lookyloo prior to version 1.35.3. The vulnerability is an XSS caused by unescaped/error message content that is propagated to innerHTML when a capture fails and the list of URLs includes an HTML element. Multiple connected sources (NVD, Red Hat, CVE list, OSV, CNNVD, etc.) ...

CVE-2025-66399

Cacti is an open source performance and fault management framework. Prior to 1.2.29, there is an input-validation flaw in the SNMP device configuration functionality. An authenticated Cacti user can supply crafted SNMP community strings containing control characters including newlines that are...

CVE-2025-13505

Datateam Datactive contains a Stored XSS vulnerability due to improper neutralization of user input during web page generation and script-related HTML tags. Affected versions are 2.13.34 up to, but not including, 2.14.0.6. The issue allows attackers to inject and execute malicious scripts in page...

Arcade MCP Server Framework 信任管理问题漏洞

Arcade MCP Server Framework is an open source MCP server framework from Arcade.dev. A trust management issue vulnerability exists in Arcade MCP Server Framework versions prior to 1.5.4, which stems from hard-coding the default working key, which could lead to bypassing the authentication layer...

PT-2025-48762

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 143.0.7499.41 Description An issue with how downloads are handled in Google Chrome could allow a remote attacker to bypass download protections. The attacker would need to convince a user to perform specific...

Google Chrome 安全漏洞

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from a mal-implementation vulnerability that stems from a DevTools mal-implementation, which can be exploited by an attacker to sandbox escape by convincing a user to install a malicious extension, possibly using a...

SAMSUNG MotionPhoto 安全漏洞

SAMSUNG MotionPhoto is a camera feature from Samsung South Korea. A security vulnerability exists in SAMSUNG MotionPhoto versions prior to 4.1.51, which stems from improper access control of the MPLocalService, which could allow a local attacker to launch a privileged service...

CVE-2025-66403

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting XSS vulnerability exists in the Filerise application due to improper handling of uploaded SVG files. The application accepts user-supplied SVG...