ASB-A-288144143

In multiple functions of btmblesec.cc, there is a possible unencrypted communication due to Invalid error handling. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-33042

creationtimestamp| type| source ---|---|--- 2026-02-12 17:51:10+00:00| seen| https://seclists.org/oss-sec/2026/q1/163 2026-02-14 18:40:27+00:00| seen| https://gist.github.com/alon710/d740d9b4112d3738012c072f4e9cd15d 2026-02-14 19:00:35+00:00| seen|...

CVE-2025-41728

creationtimestamp| type| source ---|---|--- 2026-01-27 11:38:25+00:00| seen| https://infosec.exchange/users/certvde/statuses/115966863286149942 2026-01-27 13:14:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdftnp3y3t2m...

CVE-2026-21946

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.0.0-9.2.26.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

CVE-2016-10780

cPanel before 60.0.25 allows stored XSS in the ftpsessions API SEC-180...

CVE-2022-38323

Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /RoyalEvent/updateimage.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2017-18422

In cPanel before 66.0.2, EasyApache 4 conversion sets weak domlog ownership and permissions SEC-272...

CVE-2017-18394

cPanel before 68.0.15 does not have a sufficient list of reserved usernames SEC-327...

CVE-2017-18425

In cPanel before 66.0.2, the cpdavderrorlog file can be created with weak permissions SEC-280...

CVE-2017-18397

cPanel before 68.0.15 does not preserve permissions for local backup transport SEC-330...

CVE-2017-18395

cPanel before 68.0.15 does not block a username of ssl SEC-328...

CVE-2011-0825

Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote attackers to affect confidentiality, integrity, and availability, related to Enterprise Infrastructure SEC...

CVE-2011-0836

Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote authenticated users to affect integrity, related to Web Runtime SEC...

CVE-2025-53477

creationtimestamp| type| source ---|---|--- 2026-01-08 15:06:32+00:00| seen| https://seclists.org/oss-sec/2026/q1/41 2026-01-08 16:33:55+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mbwfwryasz2d 2026-01-10 12:29:41+00:00| seen|...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992739)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992739 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - don't sleep when in softirq When kunpeng920 encryption driver is used to...

curl: libcurl WebSocket handshake accepts any Sec-WebSocket-Accept

Summary: libcurl upgrades to WebSocket without validating Sec-WebSocket-Accept, allowing a spoofed 101 response to complete the handshake and inject frames; AI assistance was used to draft this report. Steps to Reproduce: 1. Clone and build curl from source: git clone --depth=1...

CVE-2025-67899

creationtimestamp| type| source ---|---|--- 2025-12-15 19:35:51+00:00| seen| https://seclists.org/oss-sec/2025/q4/277 2025-12-20 02:01:34+00:00| seen| https://bsky.app/profile/slackers.it/post/3maf4d6dt3p2l 2025-12-21 10:46:14+00:00| seen|...

CVE-2025-66476

creationtimestamp| type| source ---|---|--- 2025-12-02 20:59:19+00:00| seen| https://seclists.org/oss-sec/2025/q4/228 2025-12-03 00:35:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m727kyx2gv2a 2025-12-04 02:30:25+00:00| seen|...

CVE-2025-66313

ChurchCRM versions 6.2.0 and earlier are vulnerable to a time-based blind SQL injection in the 1FieldSec parameter. Injecting SLEEP() triggers deterministic server-side delays, showing the value is embedded in a SQL query without proper parameterization. In the affected versions, this can enable ...

CVE-2025-52578

Incorrect Usage of Seeds in Pseudo-Random Number Generator CWE- 335 vulnerability in the High Sec ELM may allow a sophisticated attacker with physical access, to compromise internal device communications. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in...