PT-2025-26805 · Git +1 · Xmlsec

Name of the Vulnerable Software and Affected Versions: libxml2 affected versions not specified Description: The software is susceptible to a heap-buffer-overflow write issue. The crash state involves the functions xmlParsePubidLiteral, xmlParseExternalID, and xmlParseNotationDecl. Recommendations...

CVE-2025-49187

For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one...

PT-2025-25458

Name of the Vulnerable Software and Affected Versions Display Virtualization for Windows OS versions prior to 1797 Description An uncontrolled search path issue exists in some Display Virtualization for Windows OS software. This may allow an unprivileged software adversary with an authenticated...

CVE-2024-38822

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

CVE-2024-38822 CVE-2024-38822 Salt Advisory

Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion...

Malicious code in react-expiry-date (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 744273ea7bca5335d9f20514a81c835c0cad1558b2b206721aed050a41f0acea Any computer that has this package installed or running should be considered...

Malicious code in plonkscript-vscode (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd8b408dc44765c7024604210cc19ed0865efde3585895653edf022fecd41d5b Any computer that has this package installed or running should be considered...

CVE-2025-4230

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-15738)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account...

CVE-2025-4230 PAN-OS: Authenticated Admin Command Injection Vulnerability Through CLI

A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary commands as a root user. To be able to exploit this issue, the user must have access to the PAN-OS CLI. The security risk posed by this...

MAL-2025-5027 Malicious code in cim-validation-form (npm)

The package communicates with a domain associated with malicious activity...

GHSA-M3MQ-F375-5VGH Vantage6 Server JWT secret not cryptographically secure

Impact The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent Patches No Workarounds You may define JWT secret key in the server configuration file...

CVE-2025-4417 AVEVA PI Connector for CygNet Cross-site Scripting

A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator miscreant with local access to the connector admin portal to persist arbitrary JavaScript code that will be executed by other users who visit...

Hemi VDP: WordPress Version Exposure via ███████ on hemi.xyz

The WordPress CMS version was exposed in the XML file at https://hemi.xyz███. This disclosure allowed attackers to fingerprint the CMS version...

CVE-2025-49198 Poor quality of randomness in authorization tokens

The Media Server’s authorization tokens have a poor quality of randomness. An attacker may be able to guess the token of an active user by computing plausible tokens...

Malicious code in ccip-resolver (npm)

The package communicates with a domain associated with malicious activity...

Huawei EulerOS: Security Advisory for containerd (EulerOS-SA-2025-1648)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2025-25300 · Airvpn · Airvpn

Name of the Vulnerable Software and Affected Versions: AirVPN affected versions not specified Description: The issue concerns a DNS Spoofing vulnerability. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited...

CVE-2025-4275 SecureFlashDxe: Incorrect UEFI variable attributes check allows usage of invalid certificate

A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating a non-authenticated NVRAM variable. An attacker may to execute arbitrary signed UEFI code and bypass Secure Boot...