TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

Problem Local platform users who can write to TYPO3’s mail‑file spool directory can craft a file that the system will automatically deserialize without any class restrictions. This flaw allows an attacker to inject and execute arbitrary PHP code in the public scope of the web server. The...

Siemens Industrial Edge Devices

SUMMARY Siemens Industrial Edge Devices contain an authorization bypass vulnerability that could facilitate an unauthenticated remote attacker to circumvent authentication and impersonate a legitimate user. Siemens has released new versions for several affected products and recommends to update...

CVE-2025-52694

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrato...

CVE-2026-21639

A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution RCE within the affected product. Affected Products: airMAX AC Version 8.7.20 and earlier airMAX M Version 6.3.22 and earlier airFiber AF60-XG...

PT-2026-2181

Name of the Vulnerable Software and Affected Versions Mastodon versions 4.2.29, 4.3.17, 4.4.11, and 4.5.4 Description Mastodon is a social network server that makes outbound requests to user-provided domains. A protection mechanism exists to disallow requests to local IP addresses, intended to...

CVE-2025-68454 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and...

CVE-2025-68454 Craft CMS vulnerable to potential authenticated Remote Code Execution via Twig SSTI

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via Twig SSTI. For this to work, users must have administrator access to the Craft Control Panel, and...

PT-2026-1102

Name of the Vulnerable Software and Affected Versions QNAP versions prior to QTS 5.2.8.3332 build 20251128 QNAP versions prior to QuTS hero h5.2.8.3321 build 20251117 QNAP versions prior to QuTS hero h5.3.1.3250 build 20250912 Description A flaw exists that allows unauthorized access to sensitive...

Security Bulletin: IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889.

Summary IBM Maximo Application Suite - Monitor Component uses brace-expansion-1.1.11.tgz which is vulnerable to CVE-2025-5889. This bulletin contains information addressing the vulnerability. Vulnerability Details CVEID:CVE-2025-5889 DESCRIPTION: A vulnerability was found in juliangruber...

PT-2025-53649

Name of the Vulnerable Software and Affected Versions yourmaileyes MOOC versions up to 1.17 Description A security flaw exists in yourmaileyes MOOC. This issue affects the subreview function within the mooc/controller/MainController.java file of the Submission Handler component. Manipulation of t...

Siemens Advanced Licensing (SALT) Toolkit

SUMMARY Multiple Siemens products are affected by improper certificate validation in Siemens Advanced Licensing SALT Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for several affected products and recommends...

HP System Event Utility and Omen Gaming Hub – Potential Arbitrary Code Execution

HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerability was remediated with HP System Event Utility version 3.2.12 and Omen Gaming Hub version 1101.2511.101.0. Update to the latest version of HP System Even...

GHSA-98VJ-MM79-V77R Contao is vulnerable to remote code execution in template closures

Impact Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. Patches Update to Contao 4.13.57, 5.3.42 or 5.6.5 Workarounds Manually patch the Contao\Template::once method. Resources...

Multiple vulnerabilities in Security Point (Windows) of MaLion

Overview Security Point Windows of MaLion provided by Intercom, Inc. contains multiple vulnerabilities listed below. Incorrect default permissions CWE-276 - CVE-2025-59485 Stack-based buffer overflow in processing HTTP headers CWE-121 - CVE-2025-62691 Heap-based buffer overflow in processing...

MAL-2025-179890 Malicious code in lookingan-jeje2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8c132cde42647f289c34bcb8fed8cab1f1befce1696dd4e6a80e6c197b3ef1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173080 Malicious code in bafai-sunaabi-cumagau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0881afeb146eb9a60a9d15c180fa4d986f2f0bda0dfd12116d31aea666d1ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165991 Malicious code in siregar-poke7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057743918c3efa85b4a0840ebb9d196a465260cb1528e737edda779bd4cd5149 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137826 Malicious code in vina-lapis19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9db6943f03cc7d7cf923c29ea812edf3e53bfa4479d40f36989608047f9ddee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-oblok41-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29fe8b30ced7fa87f59d21835a4e729b3a8092fa0023df1482a695e10bca73c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dono-nasisayur56-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a9e74dc94007651d828fc0886ff90e7b82412eb27c544a2ba030332d432144b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...