2108 matches found
.NET 8.0 Update - November 11, 2025 (KB5071066)
None None...
CVE-2025-12728
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...
Missing Authentication
Overview Affected versions of this package are vulnerable to Missing Authentication in the xDS interface. An attacker can access sensitive configuration data, including certificate information, backend service details, routing rules, and cluster metadata, by connecting to the exposed port without...
CVE-2025-43941
Dell Unity, versions 5.5 and Prior, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability to execute arbitrary command with root privileges. This...
PT-2025-44403
Name of the Vulnerable Software and Affected Versions Dell Unity versions 5.4 and prior Description Dell Unity versions 5.4 and prior contain an Improper Neutralization of Special Elements used in an OS Command vulnerability, also known as an OS Command Injection issue. A low privileged attacker...
PT-2025-44405
Name of the Vulnerable Software and Affected Versions Dell Unity versions 5.5 and prior Description Dell Unity versions 5.5 and prior contain an Improper Neutralization of Special Elements used in an OS Command Injection issue. An attacker with local access and low privileges could potentially...
CVE-2025-64103 Zitadel Bypass Second Authentication Factor
Starting from 2.53.6, 2.54.3, and 2.55.0, Zitadel only required multi factor authentication in case the login policy has either enabled requireMFA or requireMFAForLocalUsers. If a user has set up MFA without this requirement, Zitadel would consider single factor auhtenticated sessions as valid as...
PT-2025-44319
Name of the Vulnerable Software and Affected Versions WatchGuard Mobile VPN with SSL client versions prior to 12.11.3 Description A local privilege escalation issue exists in the WatchGuard Mobile VPN with SSL client on Windows. A local user can execute arbitrary commands with elevated privileges...
PT-2026-42468
Name of the Vulnerable Software and Affected Versions Trend Micro TrendAI Apex One affected versions not specified TrendAI Apex One as a Service affected versions not specified Description An origin validation issue in the Apex One/SEP agent allows a local attacker to escalate privileges. This fl...
EUVD-2025-36470
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must...
CVE-2025-40058 iommu/vt-d: Disallow dirty tracking if incoherent page walk
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Disallow dirty tracking if incoherent page walk Dirty page tracking relies on the IOMMU atomically updating the dirty bit in the paging-structure entry. For this operation to succeed, the paging- structure memory must...
Missing Authentication for Critical Function
Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Missing Authentication for Critical Function that allows users to access to and modify content by interacting with certain APIs before email verification is...
CVE-2025-62259
Liferay Portal 7.4.0 through 7.4.3.109, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit access to APIs before a user has verified their email address, which allows remote...
Siemens SIMATIC Devices Use After Free (CVE-2024-50121)
nfsd: problematic nfsdshrinkerwork using sync mode in nfs4stateshutdownnet. In the normal case, when we excute echo 0 /proc/fs/nfsd/threads, the function nfs4statedestroynet in nfs4stateshutdownnet will release all resources related to the hashed nfs4client. This plugin only works with Tenable.ot...
PT-2025-43207
Name of the Vulnerable Software and Affected Versions Cynob IT Consultancy Auto Login After Registration versions through 1.0.0 Description The Auto Login After Registration component contains a flaw related to improper input handling during web page generation, which allows for Reflected...
Incorrect Authorization
Overview shopware/core is a Shopware platform is the core for all Shopware ecommerce products. Affected versions of this package are vulnerable to Incorrect Authorization in MediaVisibilityRestrictionSubscriber. A low‑privilege user can access sensitive customer data, such as addresses and...
EUVD-2025-34859
Agentflow developed by Flowring has an Use of Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed key to generate verification information, thereby logging into the system as any user. Attacker must first obtain an user ID in order to exploit...
HTTP Request Smuggling
Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to HTTP Request Smuggling via the interpretation of...
CVE-2023-53634
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fixed a BTI error on returning to patched function When BPFTRAMPFCALLORIG is set, BPF trampoline uses BLR to jump back to the instruction next to call site to call the patched function. For BTI-enabled kernel, the...