CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-6515 Reuse of session IDs in oatpp-mcp leads to session hijacking and prompt hijacking by remote attackers

The MCP SSE endpoint in oatpp-mcp returns an instance pointer as the session ID, which is not unique nor cryptographically secure. This allows network attackers with access to the oatpp-mcp server to guess future session IDs and hijack legitimate client MCP sessions, returning malicious responses...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

EUVD-2025-34858

The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server...

CVE-2025-11898 Flowring Technology｜Agentflow - Arbitrary File Reading through Path Traversal

Agentflow developed by Flowring has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files...

CVE-2025-62648

CVE-2025-62648 affects Restaurant Brands International (RBI) assistant platform versions up to 2025-09-06. The connected CSAF document details multiple vulnerabilities: an unauthenticated account creation path via a signup API, cleartext transmission of passwords in email, a token with administra...

CVE-2025-62646

CVE-2025-62646 affects the Restaurant Brands International assistant platform (through 2025-09-06). Multiple sources describe a vulnerability allowing a remote attacker to review stored audio of conversations between Drive Thru staff and customers. The root cause details are not explicitly provid...

Restaurant Brands International assistant platform 安全漏洞

Restaurant Brands International assistant platform is a restaurant back office platform from Restaurant Brands International. A security vulnerability exists in Restaurant Brands International assistant platform version 2025-09-06 and earlier, which originates from a remote attacker being able to...

EUVD-2025-34924

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

EUVD-2025-34926

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-62648

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to adjust Drive Thru speaker audio volume...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-62646

The Restaurant Brands International RBI assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers...

CVE-2025-56316

MCMS 5.5.0 is vulnerable to SQL injection in the content_title parameter of /cms/content/list during FreeMarker template rendering. Exploitation allows arbitrary SQL via unsanitized input. Impact is high (CVE-2025-56316 family). Remediation: upgrade net.mingsoft:ms-mcms to 6.0.2+ (per Snyk entry)...

The vulnerability of the fwnet_finish_incoming_packet() function in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the fwnetfinishincomingpacket function in the Linux operating system is related to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2025-41718

A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI...

CVE-2025-59268 BIG-IP Configuration utility vulnerability

On the BIG-IP system, undisclosed endpoints that contain static non-sensitive information are accessible to an unauthenticated remote attacker through the Configuration utility. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...