EUVD-2025-199530

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

CVE-2025-59373

A local privilege escalation vulnerability exists in the restore mechanism of ASUS System Control Interface. It can be triggered when an unprivileged actor copies files without proper validation into protected system paths, potentially leading to arbitrary files being executed as SYSTEM. For more...

Hybrid Digital Video Recorder Disclosure Unauthorized Access

The vulnerability of the hybrid digital video recorder models HBF-09KD and HBF-16NK lies in the exposure of system data to an area that is not authorized for control purposes. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

ASUS DSL Router Auth Bypass

The vulnerability of ASUS’ DSL series routers lies in the ability to bypass authentication by using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information...

Tenda AC15 Router Access Control Unauthorized Information Disclosure

The vulnerability of the Tenda AC15 router’s microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

OpenVPN memcmp Unauthenticated Access

The vulnerability of the memcmp function in OpenVPN software is related to the use of a cryptographic algorithm that has vulnerabilities when processing HMAC requests. Exploiting this vulnerability can allow an unauthorized attacker to gain unauthorized access to protected information...

ConnectWise Automate Plaintext Transmission

The vulnerability of the ConnectWise Automate platform for remote monitoring and control is related to the transmission of critical information in plaintext. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protecte...

PT-2025-47998

The Locker Content plugin for WordPress is vulnerable to Sensitive Information Exposure in version 1.0.0 via the 'lockerco submit post' AJAX endpoint. This makes it possible for unauthenticated attackers to extract content from posts that has been protected by the plugin...

video_get_user() function in the

The vulnerability of the videogetuser function in the drivers/media/v4l2-core/v4l2-ioctl.c file of the Linux kernel’s multimedia device support driver module is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access protected information...

fs/afs/fs_probe.c Heap Buffer Overflow DoS

The vulnerability of the afsfileserverproberesult function in the fs/afs/fsprobe.c module of the Andrew file system support module in the Linux operating system is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to access...

Linux TTY Console Heap Buffer Overflow DoS

The vulnerability of the vcdoresize function in the drivers/tty/vt/vt.c file of the TTY console support driver in the Linux operating system is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise the...

arch/x86/kernel/cpu/common.c Heap Buffer Overflow DoS

The vulnerability of the setupsmap function in the arch/x86/kernel/cpu/common.c module on the x86 kernel of the Linux operating system is related to an uncontrolled and exploitable condition. Exploiting this vulnerability could allow an attacker to compromise the accessibility of protected...

Mozilla Firefox Information Disclosure

The vulnerability of the Mozilla Firefox browser is related to the disclosure of information. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

KeeneticOS Inter-site Request Manipulation Unauthorized Access

The vulnerability of the KeeneticOS operating system is related to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

SAP Business One Unauthorized Access

The vulnerability of the Server Landscape Directory SLD component of the SAP Business One resource management system is related to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected...

Wazuh DecodeWinevt() Unauthorized Access

The vulnerability of the DecodeWinevt function in the Wazuh intrusion detection and prevention system is related to the output of the operation being written beyond the buffer in memory. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to...

PingAM Java Policy Agent Path Traversal

The vulnerability of the software platform for managing identification and access control in the PingAM Java Policy Agent is related to errors in processing the relative path to the directory. Exploiting this vulnerability may allow a malicious actor to gain unauthorized access to protected...

Wazuh w copy event Manipulation

The vulnerability of the w copy event function in the Wazuh intrusion detection and prevention system’s log function is related to the possibility of using memory after it has been freed. Exploiting this vulnerability could allow a remote attacker to compromise the accessibility of protected...

Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values

A mismatch exists between how Astro normalizes request paths for routing/rendering and how the application’s middleware reads the path for validation checks. Astro internally applies decodeURI to determine which route to render, while the middleware uses context.url.pathname without applying the...

Directory Traversal

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Directory Traversal via a mismatch in path normalization between routing and middleware validation. An attacker can access protected...