CVE-2025-22291

Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – Worldwide Express Edition: from n/a...

CVE-2025-1414

Memory safety bugs present in Firefox 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 135.0.1...

CVE-2025-22286

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express Edition ltl-freight-quotes-worldwide-express-edition allows Reflected XSS.This issue affects LTL Freight Quotes – Worldwide Express Edition:...

CVE-2025-23648

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wjharil AdsMiddle adsmiddle allows Reflected XSS.This issue affects AdsMiddle: from n/a through = 1.0...

CVE-2025-22630

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Marketing Fire Widget Options widget-options allows OS Command Injection.This issue affects Widget Options: from n/a through = 4.1.0...

CVE-2025-26549

Cross-Site Request Forgery CSRF vulnerability in pa1 WP Html Page Sitemap wp-html-page-sitemap allows Stored XSS.This issue affects WP Html Page Sitemap: from n/a through = 2.2...

CVE-2024-29223

Uncontrolled search path for some IntelR QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-31858

Out-of-bounds write for some IntelR QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2025-25296 Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint

Label Studio is an open source data labeling tool. Prior to version 1.16.0, Label Studio's /projects/upload-example endpoint allows injection of arbitrary HTML through a GET request with an appropriately crafted labelconfig query parameter. By crafting a specially formatted XML label config with...

RHSA-2025:1434 Red Hat Security Advisory: kpatch-patch-5_14_0-427_13_1, kpatch-patch-5_14_0-427_31_1, and kpatch-patch-5_14_0-427_44_1 security update

Bulletin has no description...

CVE-2024-35311

Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control...

CVE-2024-35558

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=rev=close...

CVE-2024-29090

Server-Side Request Forgery SSRF vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.1.4...

CVE-2024-26016

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...

RHSA-2025:1374 Red Hat Security Advisory: kpatch-patch-5_14_0-70_112_1, kpatch-patch-5_14_0-70_121_1, and kpatch-patch-5_14_0-70_85_1 security update

Bulletin has no description...

CVE-2024-31153

Improper input validation for some IntelR QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable denial of service via local access...

CVE-2024-21830

Uncontrolled search path in some IntelR VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-41934

CVE-2024-41934 affects Intel® GPA software and Intel® GPA Framework prior to version 2024.3, with an improper access control vulnerability that may allow an authenticated local attacker to cause a denial of service. Multiple sources (Intel advisory, Red Hat CVE page, PT-security entry) confirm th...

CVE-2025-25205 Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings lik...

Zertificon Z1 SecureMail 安全漏洞

Zertificon Z1 SecureMail is an email encryption and signature for businesses from Zertificon, Germany. A security vulnerability exists in Zertificon Z1 SecureMail version 4.44.2-7240-debian12, which originates from the ability to obtain sensitive information via the /compose-pdf.xhtml?convid=id...