CVE-2024-43399

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Before 4.0.7, there is a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure...

Slackware Linux 15.0 / current mariadb Vulnerability (SSA:2025-036-02)

The version of mariadb installed on the remote host is prior to 10.5.28 / 11.4.5. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-036-02 advisory. New mariadb packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

CVE-2024-0609

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'apikey' parameter in all versions up to, and including, 1.13.1 due to insufficient input sanitization and output escaping. Th...

CVE-2024-8224

A vulnerability, which was classified as critical, has been found in Tenda G3 15.11.0.20. This issue affects the function formSetDebugCfg of the file /goform/setDebugCfg. The manipulation of the argument enable/level/module leads to stack-based buffer overflow. The attack may be initiated remotel...

CVE-2025-21666

In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsockhasdata|hasspace Recent reports have shown how we sometimes call vsockhasdata when a vsock socket has been de-assigned from a transport see attached links, but we shouldn't. Previous commits...

CVE-2025-21673

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCPServerInfo::hostname When shutting down the server in cifsputtcpsession, cifsd thread might be reconnecting to multiple DFS targets before it realizes it should exit the loop, so @server-hostnam...

CVE-2025-21672

In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returning to userspace1. This is because if argc is less than 0 and the function returns directly, the held inode lock is not released. Fix this by...

CVE-2025-24608

CVE-2025-24608 refers to the WordPress GD Mail Queue plugin with a reflected XSS issue caused by improper input neutralization during page generation. Affected versions are up to 4.3 (vendor references vary; some sources list n/a through 4.3). The root cause and impact are stated in multiple reco...

CVE-2024-40673

In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-31749

WatchGuard Fireware OS (WatchGuard Firebox and XTM appliances) is affected by an authenticated remote, low-privilege command-injection in the diagnose and import pac commands prior to updates. The issue allows an attacker with unprivileged credentials to upload or read files to limited, arbitrary...

CVE-2024-45598

Cacti is an open source performance and fault management framework. Prior to 1.2.29, an administrator can change the Poller Standard Error Log Path parameter in either Installation Step 5 or in Configuration-Settings-Paths tab to a local file inside the server. Then simply going to Logs tab and...

CVE-2025-23752

creationtimestamp| type| source ---|---|--- 2025-01-27 15:16:12+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgqabcdvze2t...

CVE-2024-35144

creationtimestamp| type| source ---|---|--- 2025-01-25 14:31:55+00:00| seen| https://infosec.exchange/users/cve/statuses/113889477616794962 2025-01-25 15:05:05+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3085 2025-01-25 17:06:23+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/3106...

CVE-2025-24723

creationtimestamp| type| source ---|---|--- 2025-01-24 20:16:06+00:00| seen| https://t.me/cvedetector/16330 2025-01-24 22:32:11+00:00| seen| https://infosec.exchange/users/cve/statuses/113885703792052923...

CVE-2025-0701

creationtimestamp| type| source ---|---|--- 2025-01-24 17:08:41+00:00| seen| https://infosec.exchange/users/cve/statuses/113884431703369446 2025-01-24 19:25:43+00:00| seen| https://t.me/cvedetector/16314 2025-01-24 21:05:12+00:00| published-proof-of-concept|...

CVE-2025-22611 Coolify vulnerable to Privilege Escalation resulting in Remote Command Execution (RCE)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to escalate his or any other team members privileges to any role, including the owner role. He's also able t...

CVE-2022-47090

GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gfvvcreadppsbsinternal function of mediatools/avparsers.c, check needed for numexptilecolumns...

Oracle Linux 9 : python-jinja2 (ELSA-2025-0667)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2025-0667 advisory. 2.11.3-7 - Security fix for CVE-2024-56326 Resolves: RHEL-74690 Tenable has extracted the preceding description block directly from the Oracle Linux security...

BELL-CVE-2025-21663

Bulletin has no description...

CVE-2024-11218

A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the hos...