Cloudflare Vite plugin exposes secrets over the built-in dev server

Summary Note: originally posted on H1 but closed. Cross-posting over to here in abundance of caution instead of a public issue. When utilising the Cloudflare Vite plugin in its default configuration, all files are exposed by the local dev server, including files in the root directory that contain...

CVE-2025-49718

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network...

CVE-2025-49706 Microsoft SharePoint Server Spoofing Vulnerability

...

CVE-2025-48802 Windows SMB Server Spoofing Vulnerability

...

CVE-2025-49719

CVE-2025-49719 is an information-disclosure vulnerability in Microsoft SQL Server reported as an information disclosure due to improper input validation. Public sources indicate it affects SQL Server versions dating back to 2016 and is being addressed by Microsoft with security updates; specific ...

Sensitive Information Exposure

io.zipkin, zipkin-server is vulnerable to Sensitive Information Exposure. The vulnerability is due to the presence of an unprotected /heapdump endpoint associated with Spring Boot Actuator, which allows an attacker to retrieve memory dumps and potentially extract sensitive data. Note: There is a...

PT-2025-28372 · Siemens · Sicam Toolbox Ii

Name of the Vulnerable Software and Affected Versions: SICAM TOOLBOX II versions prior to V07.11 Description: A issue has been identified in the application where it fails to check the extended key usage attribute of a device's certificate when establishing an HTTPS connection to the TLS server o...

PT-2025-28607 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: SQL Server affected versions not specified Description: The issue is related to a heap-based buffer overflow in SQL Server, which allows an authorized attacker to execute code over a network. This can be achieved through a network connection,...

PT-2025-28608 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: SQL Server affected versions not specified Description: The issue involves the use of an uninitialized resource in SQL Server, allowing an unauthorized attacker to disclose information over a network. Recommendations: At the moment, there is ...

MongoDB Server Log Information Disclosure Vulnerability (CNVD-2025-15517)

MongoDB Server is the United States MongoDB company's set of open source NoSQL database . The database provides collection-oriented storage , dynamic query , data replication and automatic failover and other functions . A security vulnerability exists in MongoDB Server versions prior to 8.0.5,...

CVE-2025-53530 WeGIA allows Uncontrolled Resource Consumption via the errorstr parameter

WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to...

CVE-2025-53530

WeGIA is vulnerable to a Denial of Service caused by lack of validation of the length of the errorstr parameter in excessively long HTTP GET requests. Tests indicate the server processes URLs up to 8,142 characters, leading to high resource consumption, increased latency, timeouts, and read error...

CVE-2025-6713

An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCursors stage in MongoDB Server. This may lead to access to data without further authorisation. This issue affects MongoDB Server MongoDB...

CVE-2025-48501

CVE-2025-48501 is an OS command injection in Nimesa Backup and Recovery, affecting v2.3 and v2.4. The issue allows arbitrary OS commands to be executed on the server without user interaction over the network (high impact). Mitigation is to update the software to a fixed version per the vendor; mu...

xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service...

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

CVE-2025-6942

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine...

CVE-2025-52559

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting XSS vulnerability in both topi...

CVE-2025-52559 Zulip XSS in digest preview URL

Zulip is an open-source team chat application. From versions 2.0.0-rc1 to before 10.4 in Zulip Server, the /digest/ URL of a server shows a preview of what the email weekly digest would contain. This URL, though not the digest itself, contains a cross-site scripting XSS vulnerability in both topi...

CVE-2025-6942

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine...