CVE-2025-65512

A Server-Side Request Forgery SSRF vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vulnerability allows an attacker to bypass private IP restrictions through hostname-based bypass and HTTP redirect chains, enabling access to...

PT-2025-50494

Name of the Vulnerable Software and Affected Versions markdownify-mcp versions prior to 0.0.3 Description A Server-Side Request Forgery SSRF issue exists in the webpage-to-markdown conversion feature. This allows an attacker to circumvent private IP restrictions using hostname-based bypass and HT...

Barracuda Service Center 安全漏洞

Barracuda Service Center is a service center software from Barracuda USA. A security vulnerability exists in Barracuda Service Center versions prior to 2025.1.1 that originates from a URL defined in a WSDL under the control of an unauthenticated attacker, which could lead to arbitrary file writin...

CVE-2025-65512

Markdownify MCP Server vulnerability CVE-2025-65512 affects markdownify-mcp v0.0.2 and earlier. The flaw is a Server-Side Request Forgery (SSRF) in the webpage-to-markdown conversion feature that can bypass private IP restrictions via hostname-based bypass and HTTP redirect chains, enabling acces...

PT-2025-50536

Name of the Vulnerable Software and Affected Versions Aqara Hub M2 version 4.3.6 0027 Aqara Hub M3 version 4.3.6 0025 Aqara Camera Hub G3 version 4.1.9 0027 Description Aqara Hub devices do not properly validate server certificates during TLS connections used for discovery services and CoAP gatew...

PT-2025-50366

MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local...

Huawei HarmonyOS Denial of Service Vulnerability (CNVD-2025-3113638)

Huawei HarmonyOS is a distributed operating system developed independently by Huawei Technologies Co. Huawei HarmonyOS suffers from a denial-of-service vulnerability that originates from a denial-of-service vulnerability in Office Services, which can be exploited by an attacker to cause a...

CVE-2025-65291

CVE-2025-65291 affects Aqara Hub devices (Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027). The root cause is failure to validate server certificates during TLS connections used for discovery services and CoAP gateway communications, enabling potential man-in-the-middle attacks on ...

CVE-2025-62572

Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally...

CVE-2025-62572

Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally...

EUVD-2025-202240

Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally...

EU fines X $140m, tied to verification rules that make impostor scams easier

The European Commission slapped social networking company X with a €120 million $140 million fine last week for what it says was a lack of transparency with its European users. The fine, the first ever penalty under the EU's landmark Digital Services Act, addressed three specific violations with...

STAC6565 Targets Canada in 80% of Attacks as Gold Blade Deploys QWCrypt Ransomware

Canadian organizations have emerged as the focus of a targeted cyber campaign orchestrated by a threat activity cluster known as STAC6565. Cybersecurity company Sophos said it investigated almost 40 intrusions linked to the threat actor between February 2024 and August 2025. The campaign is...

CVE-2025-66461

FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed...

CVE-2025-14253

Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files...

CVE-2025-14254

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2025-14255

Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

KB5074204: Security Update for Windows PowerShell (OS Builds 26100.7392 and 26200.7392)

None None...

PT-2025-49838

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only ...

Unity Linux 20.1060a / 20.1070a Security Update: sssd (UTSA-2025-991060)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-991060 advisory. A flaw was found in the integration of Active Directory and the System Security Services Daemon SSSD on Linux systems. In default configurations, the Kerberos local...