Incorrect Authorization

Mattermost is vulnerable to Incorrect Authorization. The vulnerability is due to inadequate permission validation that allowing users with delegated granular admin roles to modify system administrators without proper restrictions...

CVE-2025-28031

TOTOLINK A810R V4.1.2cu.5182B20201026 was discovered to contain a hardcoded password for the telnet service in product.ini...

CVE-2025-3638

A flaw was found in Moodle. The analysis request action in the Brickfield tool did not include the necessary token to prevent a Cross-site request forgery CSRF risk...

Adversarial Observations in Weather Forecasting

AI-based systems, such as Google's GenCast, have recently redefined the state of the art in weather forecasting, offering more accurate and timely predictions of both everyday weather and extreme events. While these systems are on the verge of replacing traditional meteorological methods, they al...

PCMan FTP Server Buffer Overflow Vulnerability (CNVD-2025-10862)

PCMan FTP Server is a server software for File Transfer Protocol FTP. A buffer overflow vulnerability exists in PCMan FTP Server that stems from the MPUT Command Handler failing to properly process input data when processing a specific request. No detailed vulnerability details are available at...

PT-2025-17492 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Post in page for Elementor versions 1.0.1 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows for DOM-Based XSS in Post in page for...

MCMS allows arbitrary file uploads in the ueditor component

An arbitrary file upload vulnerability in the ueditor component of MCMS v5.4.3 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2025-43929

openactions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted document e.g., a document opened in KDE ghostwriter...

CVE-2025-43964

In LibRaw before 0.21.4, tag 0x412 processing in phaseonecorrect in decoders/loadmfbacks.cpp does not enforce minimum w0 and w1 values...

CVE-2025-3809

The Debug Log Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the auto-refresh debug log in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-32795

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a vulnerability was identified in the DIFY where normal users are improperly granted permissions to edit APP names, descriptions and icons. This access control flaw allows non-admin users to modify app details, despite...

CVE-2025-40364

In the Linux kernel, the following vulnerability has been resolved: iouring: fix ioreqprepasync with provided buffers ioreqprepasync can import provided buffers, commit the ring state by giving up on that before, it'll be reimported later if needed...

Denial Of Service (DoS)

github.com/bep/imagemeta is vulnerable to Denial Of Service DoS. The vulnerability is due to missing upper bounds on memory allocation when parsing metadata in PNG and WebP images, allowing an attacker to craft specially designed images with excessively large metadata...

Adobe XMP Toolkit Buffer Overflow Vulnerability

Adobe XMP Toolkit is a toolkit from the American company Audobee Adobe. Used to integrate Xmp functionality into a product or solution. Adobe XMP Toolkit suffers from a buffer overflow vulnerability that originates from an out-of-bounds read, which can be exploited by an attacker to cause a...

CVE-2024-42178

HCL MyXalytics is affected by a failure to restrict URL access vulnerability. Unauthenticated users might gain unauthorized access to potentially confidential information, creating a risk of misuse, manipulation, or unauthorized distribution...

CVE-2025-30735

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Page and Field Configuration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2025-30690

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

CVE-2025-39595

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows SQL Injection.This issue affects Quentn WP: from n/a through = 1.2.8...

CVE-2025-39532 WordPress Spice Blocks <= 2.0.7.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in spicethemes Spice Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Spice Blocks: from n/a through 2.0.7.1...

PT-2025-17066 · Bernd Altmeier · Bernd Altmeier Google Maps Gpx Viewer

Name of the Vulnerable Software and Affected Versions: Bernd Altmeier Google Maps GPX Viewer versions n/a through 3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an...