PT-2025-41000

Name of the Vulnerable Software and Affected Versions Planet WGR-500 version 1.3411b190912 Description Multiple stack-based buffer overflow issues exist in the formPingCmd functionality. An attacker can send a series of crafted HTTP requests to trigger these issues. The buffer overflow is related...

PT-2025-41001

Name of the Vulnerable Software and Affected Versions Planet WGR-500 version 1.3411b190912 Description Several stack-based buffer overflow issues are present in the formPingCmd functionality. An attacker can exploit these by sending specially crafted HTTP requests. The buffer overflow is related ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987107)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987107 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: fix page frag corruption on page fault Steffen reported a TCP stream corruption for HTTP...

Unity Linux 20.1070e Security Update: resource-agents (UTSA-2025-984791)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-984791 advisory. Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-craft...

Unity Linux 20.1060a / 20.1070a Security Update: tigervnc (UTSA-2025-986133)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986133 advisory. A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's reques...

Planet WGR-500 formPingCmd OS command injection vulnerabilities

Talos Vulnerability Report TALOS-2025-2229 Planet WGR-500 formPingCmd OS command injection vulnerabilities October 7, 2025 CVE Number CVE-2025-54406,CVE-2025-54405 SUMMARY Multiple OS command injection vulnerabilities exist in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A...

PT-2025-41003

Name of the Vulnerable Software and Affected Versions Planet WGR-500 version 1.3411b190912 Description Several stack-based buffer overflow issues are present in the formPingCmd functionality. An attacker can send a series of crafted HTTP requests to trigger these issues. The buffer overflow is...

PT-2025-41005

Name of the Vulnerable Software and Affected Versions Planet WGR-500 version 1.3411b190912 Description Several OS command injection issues are present in the swctrl functionality. A crafted network request can allow for arbitrary command execution. The new device name request parameter is involve...

PT-2025-41002

Name of the Vulnerable Software and Affected Versions Planet WGR-500 version 1.3411b190912 Description Multiple stack-based buffer overflow issues exist in the formPingCmd functionality. An attacker can send a series of HTTP requests to trigger these issues. The submit-url request parameter is...

Dell UnityVSA < 5.5.1.0 Remote Code Execution

Dell UnityVSA versions prior to 5.5.10 is vulnerable to a Remote Code Execution vulnerability due to an improper input validation. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request. No source data...

Planet WGR-500 formPingCmd format string vulnerability

Talos Vulnerability Report TALOS-2025-2228 Planet WGR-500 formPingCmd format string vulnerability October 7, 2025 CVE Number CVE-2025-48826 SUMMARY A format string vulnerability exists in the formPingCmd functionality of Planet WGR-500 v1.3411b190912. A specially crafted series of HTTP requests c...

CVE-2025-61768 Kuno CMS Vulnerable to Server-Side Request Forgery (SSRF) via Unsafe SVG Upload

KUNO CMS is a fully deployable full-stack blog application. In versions prior to 1.3.15, an SSRF Server-Side Request Forgery vulnerability exists in the Media module of the Kuno CMS administrative panel. A logged-in administrator can upload a specially crafted SVG file containing an external imag...

Improper Verification of Source of a Communication Channel

Overview sillytavern is a LLM Frontend for Power Users Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper validation of the Host header in inbound HTTP requests. An attacker can gain unauthorized access to sensitive data,...

Elasticsearch 8.18.8, 8.19.5, 9.0.8, 9.1.5 Security Update (ESA-2025-18)

Elasticsearch Insertion of sensitive information in log file ESA-2025-18 Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API Affected Versions: 7.x: All versions from 7.0.0 and u...

CVE-2025-59159 SillyTavern Web Interface Vulnerable to DNS Rebinding

SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. In versions prior to 1.13.4, the web user interface for SillyTavern is susceptible to DNS rebinding, allowing...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses requests-2.32.3-py3-none-any.whl which is vulnerable to CVE-2024-47081

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses requests-2.32.3-py3-none-any.whl which is vulnerable to CVE-2024-47081 Vulnerability Details CVEID:CVE-2024-47081 DESCRIPTION: Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior...

CVE-2025-58582 Uncontrolled Resource Consumption via log file

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged...

EUVD-2025-32497

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged...

VulnCheck KEV: CVE-2025-20363

A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance ASA Software, Cisco Secure Firewall Threat Defense FTD Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker Cisco ASA and FTD Software...

ROS-20251006-11

A vulnerability in the permissions model of the Node.js software platform is related to flaws in the processing of HTTP requests. Exploitation of the vulnerability could allow a remote attacker to bypass existing security restrictions and send unauthorized requests. existing security restrictions...