CVE-2025-26866: Deserialization of Untrusted Data

A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-based authentication to restrict cluster membership and implements a strict class whitelist to harden the Hessian serialization process...

Apple iOS < 26.2 Multiple Vulnerabilities (125884)

Binary data appleios262check.nbin...

Exploit for CVE-2025-66478

Next.js-RSC-RCE-Scanner-CVE-2025-66478 CVE-2025-66478 Next.js...

IGEL OS UMS Discovery Service Detection

Binary data igelosumsdiscoveryservicedetect.nbin...

CVE-2025-36928: Buffer Copy without Checking Size of Input

In GetHostAddress of gxpbuffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-8273: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in HYPR Server allows Identity Spoofing.This issue affects Server: before 10.1...

CVE-2025-36918: Out-of-bounds Read

In aocservicereadmessage of aocipccore.c, there is a possible out of bounds read due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

Photon OS 4.0: Linux PHSA-2025-4.0-0926

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0926. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Linux Distros Unpatched Vulnerability : CVE-2025-67477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is...

CVE-2025-67742: Improper Limitation of a Pathname to a Restricted Directory

In JetBrains TeamCity before 2025.11 path traversal was possible via file upload...

CVE-2025-36937: Out-of-bounds Write

In AudioDecoder::HandleProduceRequest of audiodecoder.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36925: Out-of-bounds Write

In WAVESsenddatatodsp of libaocwaves.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Coder Installed (Windows)

Binary data coderwininstalled.nbin...

CVE-2025-36930: Buffer Copy without Checking Size of Input

In GetHostAddress of gxpbuffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-36916: Concurrent Execution using Shared Resource with Improper Synchronization

In PrepareWorkloadBuffers of gxpmainactor.cc, there is a possible double fetch due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-58287: Improper Neutralization of Special Elements used in an OS Command

reNgine 2.2.0 contains a command injection vulnerability in the nmapcmd parameter of scan engine configuration that allows authenticated attackers to execute arbitrary commands. Attackers can modify the nmapcmd parameter with malicious base64-encoded payloads to achieve remote code execution duri...

CVE-2025-13003: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifiers. This issue affects AxOnboard: from 3.2.0 before 3.3.0...

CVE-2025-13124: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifiers. This issue affects ApplyLogic: through 01.12.2025...

CVE-2025-67739: Improper Authorization in Handler for Custom URL Scheme

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure...

CVE-2025-36889: Unintended Proxy or Intermediary

In onCreateTasks of CameraActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...