CVE-2025-54871 Electron Capture is Vulnerable to TCC Bypass via Misconfigured Node Fuses (macOS)

Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged users to bypass macOS TCC privacy protections by enabling ELECTRONRUNASNODE. This environment variable allows arbitrary Node.js code to be...

PT-2025-31929 · Rockwell Automation · Arena Simulation

Name of the Vulnerable Software and Affected Versions: Rockwell Automation Arena® Simulation affected versions not specified Description: A memory abuse issue exists in Rockwell Automation Arena® Simulation. A custom file can force the software to read and write past the end of memory space. User...

PT-2025-31954 · Halo · Halo

Name of the Vulnerable Software and Affected Versions: Halo versions prior to 2.20.18LTS Description: The reconcile method within the AttachmentReconciler class is susceptible to Cross-Site Scripting XSS attacks. Recommendations: Update to a version of Halo later than 2.20.18LTS...

MAL-2025-6768 Malicious code in thisisthedaventest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

The vulnerability of microprogrammed software in HP Color LaserJet MFP multifunctional printers, related to insufficient protection of operational data, allows attackers to gain unauthorized access to protected information.

The vulnerability of microprogrammed software in HP Color LaserJet MFP multifunctional printers is related to insufficient protection for the local address book’s service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

PT-2025-32164 · Nvidia · Nvidia Triton Inference Server

Name of the Vulnerable Software and Affected Versions: NVIDIA Triton Inference Server for Windows and Linux affected versions not specified Description: The NVIDIA Triton Inference Server contains a flaw that allows an attacker to trigger uncontrolled recursion with a crafted input. Successful...

Advisory ROSA-SA-2025-2920

software: freerdp 2.11.7 OS: ROSA-CHROME unaffected versions = freerdp-2.11.7-7 affected versions freerdp-2.11.7-7 CVE-ID: CVE-2024-32661 BDU-ID: 2024-03394 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the FreeRDP RDP client is related to null pointer dereferencing. Exploitation of the...

Advisory ROSA-SA-2025-2913

software: c-ares 1.19.1 OS: ROSA-CHROME unaffected versions = c-ares-1.19.1-2 affected versions c-ares-1.19.1-2 CVE-ID: CVE-2024-25629 BDU-ID: 2024-01708 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the aresreadline function of the C-ares asynchronous DNS query library is related to an operatio...

MAL-2025-6748 Malicious code in pexels-core-sdk (npm)

The package communicates with a domain associated with malicious activity...

PT-2025-31766 · Unknown · Mocca Calendar

Name of the Vulnerable Software and Affected Versions: Mocca Calendar versions prior to 2.15 Description: The Mocca Calendar application is susceptible to a cross-site scripting XSS issue. This occurs through a specially crafted title during calendar import. Recommendations: Update Mocca Calendar...

CVE-2025-54349

In iperf before 3.19.1, iperfauth.c has an off-by-one error and resultant heap-based buffer overflow...

CVE-2025-54351

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used for MSGTRUNC in recv...

CVE-2025-54350

In iperf before 3.19.1, iperfauth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt...

CVE-2025-23290

CVE-2025-23290 affects NVIDIA vGPU software and its Virtual GPU Manager. A vulnerability in the Virtual GPU Manager could let a guest VM read global GPU metrics influenced by other VMs, leading to information disclosure. The Red Hat/NVD/NVIDIA advisories confirm the issue and list affected compon...

CVE-2025-6077 CVE-2025-6077

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions...

CVE-2025-54790

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of backend SQL queries without direct output, potentially allowing unauthorized data access. This is fixed in version 0.16.10...

PT-2025-31738 · WordPress · Brave Conversion Engine

Name of the Vulnerable Software and Affected Versions: Brave Conversion Engine PRO plugin for WordPress versions through 0.7.7 Description: The Brave Conversion Engine PRO plugin for WordPress is susceptible to authentication bypass due to improper restriction of a claimed identity during Faceboo...

CVE-2025-54789 Files is Vulnerable to Reflected Self-XSS through its File Move Functionality

Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that prevents injection of arbitrary JavaScript, which can lead to Browser JS code execution in the context of the user’s session. This is fixed i...

CVE-2025-54136 Cursor's Modification of MCP Server Definitions Bypasses Manual Re-approvals

Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an already trusted MCP configuration file inside a shared GitHub repository or editing the file locally on the target's machine. Once a...

CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution

1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate...