CVE-2025-4971

Broadcom Automic Automation Agent Unix versions 24.3.0 HF4 and 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges...

CVE-2025-1421

Data provided in a request performed to the server while activating a new device are put in a database. Other high privileged users might download this data as a CSV file and corrupt their PC by opening it in a tool such as Microsoft Excel. The attacker could gain remote access to the user's PC...

CVE-2025-1418 Information disclosure in Proget MDM

A low-privileged user can access information about profiles created in Proget MDM Mobile Device Management, which contain details about allowed/prohibited functions. The profiles do not reveal any sensitive information including their usage in connected devices. This issue has been fixed...

SUSE CVE-2025-37963

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF programs loaded by unprivileged users is typically disabled. This means only cBPF programs need to be mitigated for BHB. In addition, only...

PT-2025-22353 · Microsoft +1 · Office Excel +1

Name of the Vulnerable Software and Affected Versions: Konsola Proget server part of the MDM suite versions prior to 2.17.5 Description: The issue arises when data provided in a request to the server during new device activation is stored in a database. High-privileged users who download this dat...

CVE-2025-4971 Broadcom Automic Automation Agent Unix privilege escalation

Broadcom Automic Automation Agent Unix versions 24.3.0 HF4 and 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges...

CVE-2025-35471

conda-forge openssl-feedstock before 066e83c 2024-05-20, on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by non-privilged local users. By writing a specially crafted openssl.cnf file in OPENSSLDIR, a non-privileged local user can execute arbitrary co...

PT-2025-20824 · Conda Forge +2 · Conda-Forge Openssl-Feedstock +2

Name of the Vulnerable Software and Affected Versions: conda-forge openssl-feedstock versions before 066e83c 2024-05-20 Miniforge versions before 24.5.0 Description: The issue concerns a configuration in conda-forge openssl-feedstock on Microsoft Windows, where OpenSSL uses an OPENSSLDIR file pat...

CVE-2025-46571

CVE-2025-46571 affects Open WebUI prior to version 0.6.6. Low-privileged users could upload HTML files containing JavaScript via the backend endpoint /api/v1/files/, which returns a file id. An attacker could lure an admin to click a link to such a file, causing the JavaScript to execute in the a...

CVE-2025-46571 Open WebUI vulnerable to limited stored XSS vila uploaded html file

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...

CVE-2025-46571 Open WebUI vulnerable to limited stored XSS vila uploaded html file

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.6, low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open t...

PT-2025-19772

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...

PT-2025-18020 · Ververica · Ververica Platform

Name of the Vulnerable Software and Affected Versions: Ververica Platform version 2.14.0 Description: The issue allows low-privileged users to access SQL connectors via a direct "namespaces/default/formats" request. Recommendations: For Ververica Platform version 2.14.0, consider restricting acce...

CVE-2025-46690

Ververica Platform 2.14.0 allows low-privileged users to access SQL connectors via a direct namespaces/default/formats request...

PT-2025-17870 · Unknown · Sherpa Orchestrator

Name of the Vulnerable Software and Affected Versions: Sherpa Orchestrator version 141851 Description: A low-privileged user can elevate their privileges by creating new users and roles. Recommendations: For Sherpa Orchestrator version 141851, consider restricting the ability of low-privileged...

The vulnerability of the SafeInspect system for privileged users stems from the lack of measures taken to protect the structure of the web page. This allows a perpetrator to execute arbitrary HTML code.

The vulnerability of the SafeInspect privilege user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to execute arbitrary HTML code remotely...

The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the SafeInspect privilege-controlled user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary JavaScript code...

The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the SafeInspect privilege control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code during the user creation process...

PT-2025-16592 · Symfonia · Ready

Name of the Vulnerable Software and Affected Versions: Ready affected versions not specified Description: The issue arises from the improper neutralization of user input in a file search function within the invoices module, allowing for SQL Injection attacks. This can be exploited by a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via Service Call functionality. A user with sufficient privileges to create Kyverno policies can expose all data from a Kubernetes cluster using a malicious Kyverno policy that makes external service cal...