CVE-2024-40114

A Cross Site Scripting XSS vulnerability in Sitecom WLX-2006 Wall Mount Range Extender N300 v1.5 and before allows an attacker to manipulate the language cookie to inject malicious JavaScript code...

CVE-2025-37095

CVE-2025-37095 is a directory traversal information disclosure vulnerability in HPE StoreOnce Software. Public records describe vulnerable software as HPE StoreOnce Software and indicate a high-severity impact (confidentiality, integrity, and availability affected) with remote, unauthenticated or...

RHEL 9 : varnish (RHSA-2025:8351)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8351 advisory. Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and ov...

WordPress WBW Product Table PRO plugin <= 2.2.6 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin WBW Product Table PRO versions = 2.2.6...

WordPress Browse As plugin <= 0.2 - Authenticated (Subscriber+) Authentication Bypass via Cookie vulnerability

Authenticated Subscriber+ Authentication Bypass via Cookie vulnerability discovered by István Márton in WordPress Plugin Browse As versions = 0.2...

WordPress WPCHURCH plugin <= 2.7.0 - Privilege Escalation Vulnerability

Privilege Escalation Vulnerability discovered by Phúc ton luoi in WordPress Plugin WPCHURCH versions = 2.7.0...

Devolutions Server <= 2024.3.15.0 / 2025.1.3.0 <= 2025.1.7.0 Improper Privilege Assignment (DEVO-2025-0008)

The version of Devolutions Server installed on the remote host is prior or equal to 2024.3.15.0 or 2025.1.3.0 through 2025.1.7.0 and is, therefore, affected by an improper privilege assignment vulnerability: - Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a...

CVE-2025-3050 IBM Db2 denial of service

IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service when using Q replication due to the improper allocation of CPU resources...

CVE-2025-48748

Netwrix Directory Manager (formerly Imanami GroupID) versions through 10.0.7784.0 contain a hard-coded password vulnerability. The CVE entry CVE-2025-48748 is rated CRITICAL (CVSS v3.1: 10.0) with network access, no authentication, and high impact to confidentiality, integrity, and availability. ...

SUSE SLES12: gstreamer-plugins-bad / gstreamer-plugins-bad-devel / etc (SUSE-SU-2025:01729-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2025:01729-1 advisory. - CVE-2025-3887: Fixed possible RCE vulnerability via buffer overflow in H265 Codec Parsing bsc1242809. Tenable has extracted the preceding descriptio...

CVE-2024-57337

An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allows attackers to execute arbitrary code via supplying a crafted file...

AlmaLinux 8 : kernel-rt (ALSA-2025:8247)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8247 advisory. kernel: wifi: rtw89: Fix array index mistake in rtw89stainfogetiter CVE-2024-43842 Tenable has extracted the preceding description block directly from the AlmaLinu...

AlmaLinux 9 : kernel (ALSA-2025:8142)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8142 advisory. kernel: cifs: Fix integer overflow while processing acregmax mount option CVE-2025-21964 Tenable has extracted the preceding description block directly from the...

AlmaLinux 8 : kernel (ALSA-2025:8246)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8246 advisory. kernel: wifi: rtw89: Fix array index mistake in rtw89stainfogetiter CVE-2024-43842 Tenable has extracted the preceding description block directly from the AlmaLinu...

CVE-2025-40911

creationtimestamp| type| source ---|---|--- 2025-05-27 21:41:00+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3lq6nk7kdp652 2025-05-27 23:41:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lq6uh33hid2a...

CVE-2025-45529

An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET request to /cms/templates/templatesAssetsEditor...

K000151542: OpenSSL vulnerability CVE-2025-4575

Security Advisory Description Issue summary: Use of -addreject option with the openssl x509 application adds a trusted use instead of a rejected use for a certificate. Impact summary: If a user intends to make a trusted certificate rejected for a particular use it will be instead marked as truste...

CVE-2025-48370 auth-js Vulnerable to Insecure Path Routing from Malformed User Input

auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFactors and deleteFactor did not require the user supplied values to be valid UUIDs. This could lead to a URL path traversal, resulting in the...

CVE-2025-23393 Reflected XSS in spacewalk-java

A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in spacewalk-java allows execution of arbitrary Javascript code on users machines.This issue affects Container suse/manager/5.0/x8664/server:5.0.4.7.19.1: from ? before 5.0.24-150600.3.25.1; SUSE Manager...

K000151528: Elasticsearch vulnerability CVE-2024-43709

Security Advisory Description An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function. CVE-2024-43709 Impact There is no impact; F5 products are not affected by this...