1949 matches found
BELL-CVE-2025-38000
Bulletin has no description...
PT-2025-24083 · Idf +1 · Idf +1
Name of the Vulnerable Software and Affected Versions: IDF versions 0.10.0-0C03-03 ZLF versions 0.10.0-0C03-04 Description: The issue allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this requires authenticating to the device and executin...
BELL-CVE-2025-4330
Bulletin has no description...
CVE-2025-5683
When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from 6.6.0 through 6.8.4, 6.9.0. This is fixed in 6.5.10, 6.8.5 and 6.9.1...
CVE-2025-49001 Dataease Authentication Bypass Vulnerability
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.10, secret verification does not take effect successfully, so a user can use any secret to forge a JWT token. The vulnerability has been fixed in v2.10.10. No known workarounds are available...
GHSA-M4JX-M5HG-QRXX django-helpdesk Allows Sensitive Data Exposure
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask0 in models.py...
PYSEC-2025-54
vLLM is an inference and serving engine for large language models LLMs. In versions 0.8.0 up to but excluding 0.9.0, hitting the /v1/completions API with a invalid jsonschema as a Guided Param kills the vllm server. This vulnerability is similar GHSA-9hcf-v7m4-6m2j/CVE-2025-48943, but for regex...
CVE-2025-48488 FreeScout Vulnerable to Stored XSS
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, deleting the file .htaccess allows an attacker to upload an HTML file containing malicious JavaScript code to the server, which can result in a Cross-Site Scripting XSS vulnerability. This issue has been patch...
CVE-2025-48481 FreeScout Has Business Logic Errors
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invitehash, can exploit this vulnerability to self-activate their account, despite it being blocked or deleted, by leveraging the invitation link fro...
CVE-2025-48471 FreeScout Vulnerable to Arbitrary File Upload
FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, the application does not check or performs insufficient checking of files uploaded to the application. This allows files to be uploaded with the phtml and phar extensions, which can lead to remote code executi...
MGASA-2025-0170 Updated ghostscript packages fix security vulnerabilities
gslibctxstashsanitizedarg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the case. A created PDF document includes its password in cleartext. CVE-2025-48708...
CVE-2024-38866 Livestatus Injection in dynmaps
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection...
PT-2025-22979 · Weidmueller · Ie-Sw-Pl10M-3Gt-7Tx +12
Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices...
PT-2025-22923 · Unknown · Summer Pearl Group Vacation Rental Management Platform
Name of the Vulnerable Software and Affected Versions: Summer Pearl Group Vacation Rental Management Platform version 1.0.1 Description: A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown part of the file /spgpm/updateListing. The...
PT-2025-22927 · Unknown · Summer Pearl Group Vacation Rental Management Platform
Name of the Vulnerable Software and Affected Versions: Summer Pearl Group Vacation Rental Management Platform versions up to 1.0.1 Description: A vulnerability was found in the Summer Pearl Group Vacation Rental Management Platform, affecting an unknown functionality and leading to cross-site...
CVE-2025-5114
creationtimestamp| type| source ---|---|--- 2025-05-23 17:21:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lpu5eeehbp2m...
CVE-2023-6578
A vulnerability classified as critical has been found in Software AG WebMethods 10.11.x/10.15.x. Affected is an unknown function of the file wm.server/connect/. The manipulation leads to improper access controls. It is possible to launch the attack remotely. To access a file like /assets/ a popup...
BELL-CVE-2025-37942
Bulletin has no description...