CVE-2025-60540: Server-Side Request Forgery (SSRF)

karakeep v0.26.0 to v0.7.0 was discovered to contain a Server-Side Request Forgery SSRF...

CVE-2025-55701: Improper Validation of Specified Type of Input

Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally...

CVE-2025-7328: Missing Authentication for Critical Function

Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks on critical functions. These could result in potential denial-of-service, admin account takeover, or NAT rule modifications. Devices would no longer be able t...

CVE-2025-41703: Missing Authentication for Critical Function

An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command...

CVE-2025-20721: Out-of-bounds Write

In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279...

CVE-2025-41705: Unprotected Transport of Credentials

An unauthenticated remote attacker MITM can intercept the websocket messages to gain access to the login credentials for the Webfrontend...

CVE-2025-41699: Improper Control of Generation of Code

An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code 'Code Injection'...

CVE-2025-7330: Cross-Site Request Forgery (CSRF)

A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on the impacted form. This allows for unintended configuration modification if an attacker can convince a logged in admin to visit a crafted link...

CVE-2025-59201: Improper Access Control

Improper access control in Network Connection Status Indicator NCSI allows an authorized attacker to elevate privileges locally...

CVE-2025-59295: Heap-based Buffer Overflow

Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network...

CVE-2025-7329: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modify sensitive data or make the webpage unavailable. The vulnerability stems from missing special character filtering and encoding. Successful exploitation...

CVE-2025-59285: Deserialization of Untrusted Data

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Photon OS 5.0: Linux PHSA-2025-5.0-0642

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0642. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

EUVD-2025-34042

A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section 'Security Update for Armoury Crate...

CVE-2025-9968

CVE-2025-9968 affects the Armoury Crate product family, specifically the UnifyScanner component. A link following vulnerability can be triggered by crafting a junction, potentially allowing local privilege escalation. Impact is described as high for confidentiality and integrity with local attack...

CVE-2025-8915: Exposure of Sensitive Information to an Unauthorized Actor

Hardcoded TLS private key and certificate in firmware in Kiloview N30 2.02.246 allows malicious adversary to do a Mann-in-the-middle attack via the network...

CVE-2025-27259: Improper Neutralization of Input During Web Page Generation

Ericsson Network Manager versions prior to ENM 25.2 GA contain a vulnerability that, if exploited, can exfiltrate limited data or redirect victims to other sites or domains...

CVE-2025-9902: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in AKIN Software Computer Import Export Industry and Trade Co. Ltd. QRMenu allows Privilege Abuse. This issue affects QRMenu: from 1.05.12 before Version dated 05.09.2025...

CVE-2025-11184: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in QGIS QWC2 Registration GUI =v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page...

CVE-2025-0636: Improper Neutralization of Special Elements used in an OS Command

EMCLI contains a high severity vulnerability where improper neutralization of special elements used in an OS command could be exploited leading to Arbitrary Code Execution...