CVE-2025-13425: NULL Pointer Dereference

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic index out of range and an application crash denial of service in OSV-SCALIBR...

CVE-2025-64770: Missing Authentication for Critical Function

The affected products allow unauthenticated access to Open Network Video Interface Forum ONVIF services, which may allow an attacker unauthorized access to camera configuration information...

CVE-2025-65226: Buffer Copy without Checking Size of Input

Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the deviceId parameter in /goform/saveParentControlInfo...

CVE-2025-65220: Stack-based Buffer Overflow

Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow in: /goform/SetVirtualServerCfg via the list parameter...

CVE-2025-59245: Deserialization of Untrusted Data

Microsoft SharePoint Online Elevation of Privilege Vulnerability...

CVE-2025-62459: Improper Neutralization of Input During Web Page Generation

Microsoft Defender Portal Spoofing Vulnerability...

CVE-2025-62207: Server-Side Request Forgery (SSRF)

Azure Monitor Elevation of Privilege Vulnerability...

CVE-2025-62674: Missing Authentication for Critical Function

The affected product allows unauthenticated access to Real Time Streaming Protocol RTSP services, which may allow an attacker unauthorized access to camera configuration information...

CVE-2025-12502: Undefined Security Weakness

The attention-bar WordPress plugin through 0.7.2.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users such as administrator to perform SQL injection attacks...

CVE-2025-65221: Stack-based Buffer Overflow

Tenda AC21 V16.03.08.16 is vulnerable to Buffer Overflow via the list parameter of /goform/setPptpUserList...

CVE-2025-61138: Insertion of Sensitive Information into Externally-Accessible File or Directory

Qlik Sense Enterprise v14.212.13 was discovered to contain an information leak via the /dev-hub/ directory...

CVE-2025-40605: Relative Path Traversal

A Path Traversal vulnerability has been identified in the Email Security appliance allows an attacker to manipulate file system paths by injecting crafted directory-traversal sequences such as ../ and may access files and directories outside the intended restricted path...

The vulnerability of the malware scanning service of the Linux web server security platform Imunify360 allows a hacker to execute arbitrary code and trigger a service failure.

The vulnerability of the malware scanning service on the Ai-Boilt security platform for Linux web servers, Imunify360, is related to the failure to implement measures to neutralize instructions in the dynamically executed code. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2025-10571: Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: 3.2.0.0, 3.2.1.1...

Dell SmartFabric OS10 Detection

Binary data dellsmartfabricos10detect.nbin...

Samsung MagicINFO Server Detection

Binary data samsungmagicinfoserverdetect.nbin...

CVE-2025-11446: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects upKeeper Manager: from 5.2.0 before 5.2.12...

CVE-2025-13147: Server-Side Request Forgery (SSRF)

Server-Side Request Forgery SSRF vulnerability in Progress MOVEit Transfer.This issue affects MOVEit Transfer: before 2024.1.8, from 2025.0.0 before 2025.0.4...

CVE-2025-11963: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities allows Reflected XSS. This issue affects StarCities: before 1.1.61...

CVE-2025-65095: Improper Neutralization of Input During Web Page Generation

Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.35.1, there is potential cross-site scripting on index and tree page. This issue has been patched in version 1.35.1...