CVE-2025-6942

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine...

CVE-2025-6942

Affected product: Delinea Secret Server distributed engine. Versions 8.4.39.0 and earlier (within Secret Server 11.7.49 and earlier) are vulnerable. Root cause: insufficient validation during the initial authorization event, enabling impersonation of another distributed engine. Impact: attacker c...

CVE-2025-6942

The distributed engine versions 8.4.39.0 and earlier of Secret Server versions 11.7.49 and earlier can be exploited during an initial authorization event that would allow an attacker to impersonate another distributed engine...

Command Injection

@cyanheads/git-mcp-server is vulnerable to command injection. The vulnerability is due to the unsanitized use of user input in childprocess.exec, which allows an attacker to inject arbitrary shell commands and achieve remote code execution under the server's privileges...

PT-2025-27658 · Unknown · Secret Server

Name of the Vulnerable Software and Affected Versions: Secret Server versions 11.7.49 and earlier Description: The distributed engine of Secret Server can be exploited during an initial authorization event, allowing an attacker to impersonate another distributed engine. Recommendations: For Secre...

Exploit for Improper Neutralization of Null Byte or NUL Character in Wftpserver Wing_Ftp_Server

CVE-2025-47812-poC Simple exploit for Wing FTP Server RCE CVE...

Security Bulletin: Waitress WSGI Server Vulnerability: HTTP Pipelining Request Handling with Disabled Lookahead

Summary Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recvbytes defaults to 8192 long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled default we won't read any more requests, and...

CVE-2025-53100 RestDB's Codehooks.io MCP Server Vulnerable to Command Injection

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated...

CVE-2025-53100 RestDB's Codehooks.io MCP Server Vulnerable to Command Injection

RestDB's Codehooks.io MCP Server is an MCP server on the Codehooks.io platform. Prior to version 0.2.2, the MCP server is written in a way that is vulnerable to command injection attacks as part of some of its MCP Server tools definition and implementation. This could result in a user initiated...

CVE-2025-34053

An authentication bypass vulnerability exists in AVTECH IP camera, DVR, and NVR devices’ streamd web server. The strstr function is used to identify ".cab" requests, allowing any URL containing ".cab" to bypass authentication and access protected endpoints...

CVE-2025-34065

The CVE-2025-34065 vulnerability affects AVTECH IP cameras, DVRs, and NVRs (streamd web server). The issue is an authentication bypass where the strstr() function allows unauthenticated access to any request containing "/nobody" in the URL, bypassing login controls. Affected systems are AVTECH de...

CVE-2025-6706

An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut down a server. The crash is triggered on affected versions by issuing an aggregation framework operation using a specific...

ESPAsyncWebServer 注入漏洞

ESPAsyncWebServer is an asynchronous web server from the ESP32 Asynchronous Networking community for microcontrollers such as the ESP8266 and ESP32. An injection vulnerability exists in ESPAsyncWebServer version 3.7.8 and earlier, which stems from a CRLF injection in the HTTP header construction...

CVE-2025-6710

MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the server to crash which coul...

CVE-2025-52573

CVE-2025-52573 affects the iOS Simulator MCP Server (ios-simulator-mcp). The vulnerability arises in the MCP Server’s tool definitions (notably the ui_tap tool) which rely on Node.js child process API exec. When untrusted input is used for parameters such as duration, udid, x, and y, shell meta-c...

CVE-2025-49603

Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control...

PT-2025-30925 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: A path traversal issue exists in Salesforce Tableau Server on Windows and Linux due to improper...

PT-2025-30923 · Salesforce · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: An authorization bypass issue exists in Salesforce Tableau Server on Windows and Linux due to a...

MongoDB -- Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDB

[email protected] reports: MongoDB Server may be susceptible to stack overflow due to JSON parsing mechanism, where specifically crafted JSON inputs may induce unwarranted levels of recursion, resulting in excessive stack space consumption. Such inputs can lead to a stack overflow that causes the...

PT-2025-26973

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 6.0.21 MongoDB Server versions 7.0.0 through 7.0.16 MongoDB Server versions 8.0.0 through 8.0.4 Description: The MongoDB Server is susceptible to a denial of service issue due to improper handling of specific...