CVE-2025-4779

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting XSS. An unauthenticated attacker can inject malicious JavaScript into the "v1/runs/ingest" endpoint by adding an empty "citations" field, triggering a code path where "dangerouslySetInnerHTML" is used to rende...

CVE-2025-4779: Improper Neutralization of Input During Web Page Generation

lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting XSS. An unauthenticated attacker can inject malicious JavaScript into the v1/runs/ingest endpoint by adding an empty citations field, triggering a code path where dangerouslySetInnerHTML is used to render...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

FreeScout support service management system Information Disclosure Session Control

The vulnerability of the FreeScout support service management system lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to disclose confidential information and gain control over user sessions...

Multiple Advantech Products Information Disclosure Vulnerabilities

The Advantech WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN are all industrial automation controllers from Advantech of Taiwan, China. An information disclosure vulnerability exists in multiple Advantech products, which can be exploited by attackers to cause data interception and session hijacking...

FreeScout support service management system Information Disclosure Session Control

The vulnerability of the FreeScout support service management system lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to disclose confidential information and gain control over user sessions...

Endress+Hauser MEAC300-FNADE4 security vulnerability

The Endress+Hauser MEAC300-FNADE4 is a cost-effective emissions data management computer from Endress+Hauser Vietnam. A security vulnerability exists in the Endress+Hauser MEAC300-FNADE4 that stems from the HttpOnly flag not being set, which can be exploited by an attacker to cause session...

Endress+Hauser MEAC300-FNADE4 security vulnerability

The Endress+Hauser MEAC300-FNADE4 is a cost-effective emissions data management computer from Endress+Hauser Vietnam. A security vulnerability exists in the Endress+Hauser MEAC300-FNADE4 that stems from a missing Secure attribute, which can be exploited by an attacker to cause session hijacking...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814

The NovelSat NS3000 and NovelSat NS2000 satellite demodulators are vulnerable to a security flaw due to missing authentication checks for critical functions. Specifically, the query.fcgi endpoint in NS3000 versions v8.1.1.125110 , v7.2.8.124852 , and v7.x , as well as NS2000 version v7.02.08 , la...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814: Missing Authentication for Critical Function

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

CVE-2025-45814

Missing authentication checks in the query.fcgi endpoint of NS3000 v8.1.1.125110 , v7.2.8.124852 , and v7.x and NS2000 v7.02.08 allows attackers to execute a session hijacking attack...

Security vulnerabilities in NovelSat NS3000 and NovelSat NS2000

The NovelSat NS3000 and NovelSat NS2000 are both satellite modems from NovelSat, an Israeli company. A security vulnerability exists in NovelSat NS3000 and NovelSat NS2000 that stems from a lack of authentication checks and could lead to session hijacking. The following products and versions are...

Cisco Meraki 16.2 / 17 / 18.1 < 18.107.13 / 18.2 < 18.211.3 DoS (cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X)

The version of the remote Cisco Meraki device is 16.2, 17, 18.1 prior to 18.107.13, or 18.2 prior to 18.211.3. It is, therefore, potentially affected by a denial of service vulnerability as referenced in the cisco-sa-meraki-mx-vpn-dos-by-QWUkqV7X advisory: - A vulnerability in the Cisco AnyConnec...

PT-2025-27663

Name of the Vulnerable Software and Affected Versions: NS3000 versions 7.x through 8.1.1.125110 NS2000 version 7.02.08 Description: The issue is related to missing authentication checks in the "query.fcgi" endpoint, which allows attackers to execute a session hijacking attack. Recommendations: Fo...

CVE-2025-52553

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...

CVE-2025-52553

authentik is an open-source identity provider. After authorizing access to a RAC endpoint, authentik creates a token which is used for a single connection and is sent to the client in the URL. This token is intended to only be valid for the session of the user who authorized the connection, howev...

CVE-2025-52553

CVE-2025-52553 affects authentik (open-source identity provider). The vulnerability arises from a session-specific, single-use token generated after authorizing access to a RAC endpoint that is embedded in the URL; the check ensuring the token is valid only for the originating user’s session is m...