CVE-2025-10653: Authentication Bypass Using an Alternate Path or Channel

An unauthenticated debug port may allow access to the device file system...

CVE-2025-61691: Out-of-bounds Read

VT STUDIO versions 8.53 and prior contain an out-of-bounds read vulnerability. If the product uses a specially crafted file, arbitrary code may be executed on the affected product...

CVE-2025-57305: Server-Side Request Forgery (SSRF)

VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp...

CVE-2025-59684: Uncontrolled Search Path Element

DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking...

CVE-2025-61188: Path Traversal: '../filedir'

Jeecgboot versions 3.8.2 and earlier are affected by a path traversal vulnerability. This vulnerability allows attackers to upload files with system-whitelisted extensions to the system directory /opt, instead of the /opt/upFiles directory specified by the web server...

Photon OS 5.0: Coredns PHSA-2025-5.0-0623

An update of the coredns package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0623. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-57275: Buffer Copy without Checking Size of Input

Storage Performance Development Kit SPDK 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf...

CVE-2025-8122: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

CVE-2025-8121: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of input provided by an authorized user in article positioning functionality allows for Blind SQL Injection attacks. This issue affects all 3 templates: www, bip and ww+bip. This product is End-Of-Life and producent will not publish patches for this vulnerability...

CVE-2025-54476: Improper Neutralization of Input During Web Page Generation

Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class...

CVE-2025-54477: Observable Discrepancy

Improper handling of authentication requests lead to a user enumeration vector in the passkey authentication method...

Photon OS 5.0: Linux PHSA-2025-5.0-0630

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0630. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-10504: Heap-based Buffer Overflow

Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33...

CVE-2024-57412: Uncontrolled Resource Consumption

An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service DoS via repeatedly sending crafted TCP packets...

CVE-2025-11155: Weak Encoding for Password

The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials...

CVE-2024-13150: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Fayton Software and Consulting Services fayton.Pro ERP allows SQL Injection. This issue affects fayton.Pro ERP: through 20250929...

Apple iOS < 18.7.1 Vulnerability (125327)

Binary data appleios1871check.nbin...

CVE-2025-11078: Unrestricted Upload of File with Dangerous Type

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/controller.php?action=photos. The manipulation of the argument photo leads to unrestricted upload. The attack is possible to be carried out...

CVE-2025-36239: Improper Neutralization of Input During Web Page Generation

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-60114: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through = 3.3.1...