CVE-2025-46820

phpgt/Dom provides access to modern DOM APIs. Versions of phpgt/Dom prior to 4.1.8 expose the GITHUBTOKEN in the Dom workflow run artifact. The ci.yml workflow file uses actions/upload-artifact@v4 to upload the build artifact. This artifact is a zip of the current directory, which includes the...

CVE-2025-46815 ZITADEL Allows IdP Intent Token Reuse

The identity infrastructure software ZITADEL offers developers the ability to manage user sessions using the Session API. This API enables the use of IdPs for authentication, known as idp intents. Following a successful idp intent, the client receives an id and token on a predefined URI. These id...

CVE-2025-46587

Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-58252

Vulnerability of insufficient information protection in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-58252

Technical details about CVE-2024-58252 are not publicly available in the provided connected documents. Monitoring for updates is recommended; no confirmed affected products, versions, root cause, exploitability, or fixes are described in the supplied sources.

CVE-2025-46587

Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

Optigo Networks ONS NC600

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to establish an authenticated connection with the hard-coded credentials and perform OS command executions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

PT-2025-19975 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns unauthorized access in the app lock module. Successful exploitation of this vulnerability will affect integrity and confidentiality. No information is provided about the...

ROS-20250505-05

The vulnerability of the Zabbix universal monitoring system is related to insufficient cleansing of user data passed via the "groupBy" parameter in include/classes/api/CApiService.php. Exploitation of the vulnerability could allow a remote attacker to execute arbitrary SQL queries in the database...

PT-2025-19976 · Huawei · Harmonyos

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue concerns unauthorized access in the app lock module. Successful exploitation of this vulnerability will affect integrity and confidentiality. Recommendations: At the moment, there ...

The vulnerability of the microprogramming software of the Uniswap Universal Router, which allows a hacker to cause a service failure.

The vulnerability of the Uniswap Universal Router’s microprogramming software is related to insufficient blocking mechanisms. Exploiting this vulnerability could allow a malicious actor to cause service failures...

PT-2025-18753 · WordPress · Smart Framework

Name of the Vulnerable Software and Affected Versions: WordPress plugins and/or themes using Smart Framework affected versions not specified Description: The issue is related to Stored Cross-Site Scripting due to a missing capability check on the saveOptions and importThemeOptions functions. This...

PT-2025-18388 · Elastic · Endpoint Security +1

Name of the Vulnerable Software and Affected Versions: Elastic Agent and Elastic Security Endpoint affected versions not specified Description: Exposure of sensitive information to local unauthorized actors can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. Th...

NVIDIA Linux GPU Display Driver (April 2025)

A display driver installed on the remote Linux host is affected by a vulnerability: - NVIDIA GPU Display Driver for Linux contains a vulnerability which could allow an unprivileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution, denial of...

PT-2025-18696 · Unknown · Microdicom Dicom Viewer

Name of the Vulnerable Software and Affected Versions: MicroDicom DICOM Viewer affected versions not specified Description: The issue concerns a memory corruption problem due to an out-of-bounds read. This could be exploited if a user opens a malicious DCM file, potentially allowing an attacker t...

Dell PowerProtect Data Manager Reporting Information Disclosure Vulnerability

Dell PowerProtect Data Manager Reporting is a data protection management software. An information disclosure vulnerability exists in Dell PowerProtect Data Manager Reporting, which arises from the program's failure to properly handle template input and can be exploited by an attacker to obtain...

ABB Automation Builder (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to overrule the Automation Builder's user management. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

PT-2025-18778 · Undefined · Undefined

Multiple ransomware groups were spotted exploiting a vulnerability, tracked as CVE-2023-27532, in Veeam Backup & Replication. The vulnerability CVE-2023-275327 CVSS score of 7.5 impacts the Veeam Backup & Replication ... https://t.co/RPMhUoDv7P...

WordPress Plugin 1 Decembrie 1918 Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...

GHSA-WC9G-6J9W-HR95 YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download

Summary The request to commence a site backup can be performed without authentication. Then these backups can also be downloaded without authentication. The archives are created with a predictable filename, so a malicious user could create an archive and then download the archive without being...