CVE-2025-68400

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint /Reports/ConfirmReportEmail.php in ChurchCRM prior to version 6.5.3. Although the feature was removed from the UI, the file remains deployed and reachable directly via URL. This is a...

epynn (>=1.2.0, <=1.2.13), jupyter-web-report (0.2.1) +1 more potentially affected by CVE-2025-53000 via nbconvert (5.4.1)

nbconvert PYPI version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - epynn =1.2.0, =0.1.7, =0.2.0 Source cves: CVE-2025-53000 Source advisory: OSV:GHSA-XM59-RQC7-HHVF...

CVE-2025-65566

A denial-of-service vulnerability exists in the omec-project UPF pfcpiface component in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead ...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the session report handler process when handling a PFCP Session Report Response that lacks the mandatory Cause Information Element. An attacker can cause the process to panic and terminate by sending speciall...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the session report handler process when handling a PFCP Session Report Response that lacks the mandatory Cause Information Element. An attacker can cause the process to panic and terminate by sending speciall...

CVE-2025-40892

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a...

CVE-2025-40892

CVE-2025-40892 is a Stored XSS in Nozomi Guardian/CMC Reports functionality caused by improper validation of an input parameter. An authenticated user with report privileges can craft or import a malicious report template containing JavaScript; when viewed or imported, the payload executes in the...

North Korea-Linked Hackers Steal $2.02 Billion in 2025, Leading Global Crypto Theft

Threat actors with ties to the Democratic People's Republic of Korea DPRK or North Korea have been instrumental in driving a surge in global cryptocurrency theft in 2025, accounting for at least $2.02 billion out of more than $3.4 billion stolen from January through early December. The figure...

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electrics Products

RISK EVALUATION Successful exploitation of this vulnerability could result in denial-of-service DoS, information tampering, and information disclosure. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...

EUVD-2025-204016

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2025-52220

A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing a JavaScript payload, or a victim can be socially engineered to import a...

CVE-2025-65566

A denial-of-service vulnerability exists in the omec-project UPF pfcpiface component in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead ...

CVE-2025-65566: NULL Pointer Dereference

A denial-of-service vulnerability exists in the omec-project UPF pfcpiface component in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead ...

CVE-2025-65566

The omec-project UPF (specifically the pfcpiface component) is vulnerable to a NULL Pointer Dereference in version upf-epc-pfcpiface:2.1.3-dev . The flaw occurs in the session report handler when processing a PFCP Session Report Response that lacks the mandatory Cause Information Element . Instea...

PT-2025-52293

Name of the Vulnerable Software and Affected Versions omec-project UPF versions upf-epc-pfcpiface:2.1.3-dev Description A denial-of-service issue exists in the pfcpiface component of the UPF. When the UPF receives a PFCP Session Report Response lacking the mandatory Cause Information Element, the...

UPF security vulnerabilities

UPF is an open source user interface from the Aether SD-Core Project. A security vulnerability exists in UPF upf-epc-pfcpiface:version 2.1.3-dev, which originates from dereferencing a null pointer when processing a PFCP session report response that lacks a cause information element, which could...

What Cyber Defenders Really Think About AI Risk

Learn how Trend Micro's 2025 Trend Micro Defenders Survey Report highlights current AI-related cybersecurity priorities and where security professionals use AI to their advantage...

CVE-2025-65566

A denial-of-service vulnerability exists in the omec-project UPF pfcpiface component in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead ...

Release Information for Veeam Backup for Microsoft 365 8.3

More Recent Version Available Please find the latest version of Veeam Backup for Microsoft 365 here: Veeam Downloads - Latest Version Build Numbers and Versions of Veeam Backup for Microsoft 365 Requirements This release can be used to: upgrade an existing v7, v8, v8.1, or v8.2 deployment of Veea...

GHSA-J22H-9J4X-23W5 mcp-server-git has missing path validation when using --repository flag

In mcp-server-git versions prior to 2025.12.18, when the server is started with the --repository flag to restrict operations to a specific repository path, it did not validate that repopath arguments in subsequent tool calls were actually within that configured path. This could allow tool calls t...