PT-2025-26668 · Git +1 · Xmlsec

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software contains a heap-buffer-overflow vulnerability. The crash state indicates the issue occurs within the xmlParsePubidLiteral, xmlParseExternalID, and xmlParseDocTypeDecl functions...

CVE-2025-24919

creationtimestamp| type| source ---|---|--- 2025-06-13 22:37:28+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18347 2025-06-13 23:14:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrjkueqdv52r 2025-08-06 13:05:54+00:00| seen|...

CVE-2025-48914

creationtimestamp| type| source ---|---|--- 2025-06-13 16:37:24+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18316 2025-06-13 17:31:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrixouteeg2k 2025-06-13 20:02:32+00:00| seen|...

CVE-2025-49580

creationtimestamp| type| source ---|---|--- 2025-06-13 16:37:17+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18312 2025-06-13 17:05:18+00:00| published-proof-of-concept| Telegram/LbSE4ui0deWaIbAIySI6HyoY8sH4t9aZhKhv-gkpgMW3iE 2025-06-13 17:35:32+00:00| seen|...

Brotli decompression bomb DoS

Description urllib3 can not stream brotli-encoded responses properly unlike the way it handles gzip responses. It always loads entire decompressed response body into memory when reading brotli-encoded response, which allows malicious servers to perform DoS attack by responding with decompression...

Full system file read and delete via GET /api/v1/images/download/{bulk_download_item_name}

Description For invokeai version v6.0.0a1 and below, there is an endpoint for bulk downloading zip file. With some manipulation of the filename arguments, attacker can read and also delete any files on the server through this endpoint. P/S: Tested on Windows Proof of Concept Request: GET...

Automattic: Woocommerce SQL Injection in WC_Report_Coupon_Usage

A SQL injection vulnerability was found in the WooCommerce plugin version 9.9.3. The vulnerable parameter was 'couponcodes' in the '/wp-admin/admin.php?page=wc-reports&tab=orders&report=couponusage' endpoint. The vulnerability required the privilege to view reports...

CVE-2025-4584

The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and including, 1.2.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2025-5938

creationtimestamp| type| source ---|---|--- 2025-06-13 02:33:58+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18245 2025-06-13 05:11:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhoeb6taj2k...

CVE-2025-27689

creationtimestamp| type| source ---|---|--- 2025-06-12 21:34:40+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18233 2025-06-13 01:04:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrhak33t4h2e 2025-06-13 06:05:09+00:00| seen|...

CVE-2025-21767

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05...

CVE-2025-35452

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-10 2025-09-05 20:10:42+00:00| seen| https://t.me/canyoupwnme/6911 2025-09-06 06:01:22+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3ly5iriwsde2...

CVE-2025-44019

creationtimestamp| type| source ---|---|--- 2025-06-12 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-07 2025-06-12 20:31:06+00:00| seen| Telegram/0yMPK4CpiDURHf7-h9WUwgfi4xtxnRXL0cNHjNvGP0ZDac 2025-06-12 20:34:16+00:00| seen|...

CVE-2025-49819

creationtimestamp| type| source ---|---|--- 2025-06-12 05:47:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrf7wepavb2u...

CVE-2025-6008

creationtimestamp| type| source ---|---|--- 2025-06-12 02:33:28+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18142 2025-06-12 05:48:56+00:00| published-proof-of-concept| Telegram/1Aa4wx5C77-QnNp1HoIjIHD7JstDp4QgHQR99I-iOvE2Mo 2025-06-12 06:07:24+00:00| seen|...

OSV-2025-456 Use-of-uninitialized-value in ppd_hash_option

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=423674620 Crash type: Use-of-uninitialized-value Crash state: ppdhashoption cupsArrayFind ppdFindOption...

CVE-2025-6001

creationtimestamp| type| source ---|---|--- 2025-06-11 16:50:44+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114665759988523805 2025-06-11 18:35:12+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18121 2025-06-11 19:23:49+00:00| seen|...

CVE-2025-1699

CVE-2025-1699: The MotoSignature application is affected by an incorrect default permissions vulnerability that could allow unauthorized access. The entry is corroborated by multiple sources (NVD/NVD-centric, Red Hat CVE page, CVE lists) noting MotoSignature as the affected component. Exploitatio...

CVE-2025-4230

creationtimestamp| type| source ---|---|--- 2025-06-11 14:00:00+00:00| seen| https://security.paloaltonetworks.com/CVE-2025-4230 2025-06-11 19:03:31+00:00| seen| https://bsky.app/profile/ripjyr.bsky.social/post/3lre3w2cxq52h 2025-06-13 00:32:33+00:00| seen|...

CVE-2024-1244

creationtimestamp| type| source ---|---|--- 2025-06-11 03:37:02+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/18040 2025-06-11 05:18:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lrcnthzptu2a 2025-06-11 11:03:35+00:00| seen|...