Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...

PT-2026-25895

Name of the Vulnerable Software and Affected Versions libsoup affected versions not specified Description A Use-After-Free flaw exists in the libsoup library, specifically within the HTTP/2 server implementation. A remote attacker can exploit this by sending crafted HTTP/2 requests that trigger...

CVE-2025-15226

CVE-2025-15226 concerns WMPro by Sunnet, where an Arbitrary File Upload vulnerability allows unauthenticated remote attackers to upload and execute a web shell on the server, enabling arbitrary code execution . The vulnerability is described in multiple feeds (NVD/Red Hat/CIRCL/etc.) with no spec...

PT-2025-53424

CVE-2025-68691 - VMware Server Privilege Escalation Vulnerability CVE ID : CVE-2025-68691 Published : Dec. 24, 2025, 4:15 a.m. | 50 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The vulnerability of the web server of the microprogramming software for devices used in integrating and managing industrial automation systems, the General Industrial Controls Lynx+ Gateway, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the web server of the microprogramming software for devices used in integrating and managing industrial automation systems, the Lynx+ Gateway, is related to the absence of authentication for critical functions. Exploiting this vulnerability could allow a malicious actor,...

The vulnerability of the SAP MDM Server data management server, related to the release of previously unallocated memory, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SAP MDM Server data management server is related to the release of previously unallocated memory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

httpd: Apache HTTP Server: CGI environment variable override

A configuration override flaw has been discovered in the apache HTTP server. Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server...

rsync: Path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

PT-2025-52448

Name of the Vulnerable Software and Affected Versions Turms IM Server versions prior to 0.10.0-SNAPSHOT Description The software contains a flaw in access control related to querying user online status. An authenticated user can access online status, device information, and login timestamps of an...

ROS-20251219-7303

A vulnerability in the MongoDB database management system server is related to the use of assert or a similar operator. Exploitation of the vulnerability could allow a remote attacker to affect the availability of protected information...

Exploit for Use of Client-Side Authentication in Necta Wifi_Mouse_Server

Paso 1 — Crear un payload REAL Windows msfvenom -p windows/x6...

Cross-site Request Forgery (CSRF)

Overview github.com/mattermost/mattermost-plugin-calls/server is a package that enables voice calling and screen sharing functionality in Mattermost channels Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the Calls widget page. An attacker can initiate cal...

Model Context Protocol Servers 路径遍历漏洞

Model Context Protocol Servers is a large model context protocol server from Model Context Protocol open source. A path traversal vulnerability exists in versions of Model Context Protocol Servers prior to 2025.12.17, which stems from a failure to verify that the repopath parameter in subsequent...

CVE-2025-67073

The Tenda AC10V4.0 wireless router (version V16.03.10.20 ) is vulnerable to a buffer overflow in the fromAdvSetMacMtuWan function of the httpd binary. Remote attackers can exploit this by sending a POST request with a crafted payload in the serviceName field to the /goform/AdvSetMacMtuWan endpoin...

Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter

Impact The Instagram authentication adapter allows clients to specify a custom API URL via the apiURL parameter in authData. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. Patches Fixed by hardcoding the...

PT-2025-51158

Name of the Vulnerable Software and Affected Versions Tenda AC20 version 16.03.08.12 Description A stack-based buffer overflow exists in the formSetPPTPUserList function within the httpd component. This issue is triggered by manipulating the argument list. The attack can be executed remotely. The...

DoS (Denial of Service) com.fasterxml.jackson.core:jackson-core Dependency in Bitbucket Data Center and Server

This High severity DoS Denial of Service vulnerability was introduced in version 8.19.0 and 9.4.0 of Bitbucket Data Center and Server. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7, allows an attacker to perform actions to degrade service, which has no impact to...

Injection in Crowd Data Center and Server

This is a vulnerability in a non-Atlassian Crowd dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability known as CVE-2025-9288 was introduced in versions 2.2.6, 2.4.11, 6.2.4, 6.3.0, and 7.1.0 of Crowd Da...

Injection in Crowd Data Center and Server

This is a vulnerability in a non-Atlassian Crowd dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Injection vulnerability known as CVE-2025-9287 was introduced in versions 1.0.4, 6.2.4, 7.0.0, and 7.1.0 of Crowd Data Cente...

The vulnerability of the Apache HTTP Server web server arises from the failure to take measures to neutralize specific control elements, allowing attackers to influence the confidentiality and integrity of the protected information.

The vulnerability of the Apache HTTP Server is related to the lack of measures taken to neutralize specific control elements. Exploiting this vulnerability allows a remote attacker to influence the confidentiality and integrity of the protected information...