CVE-2025-31173

Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2025-31171

CVE-2025-31171 describes a file read permission bypass in the kernel file system module, affecting Huawei HarmonyOS. The vulnerability allows bypass of read permissions within the kernel file system component, with potential impact to service confidentiality (local exploitation; low attack comple...

CVE-2024-58107

Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability...

CVE-2025-3253 xujiangfei admintwo insertTree cross site scripting

A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed t...

CVE-2025-3203 Tenda W18E setModules formSetAccountList stack-based overflow

A vulnerability classified as problematic was found in Tenda W18E 16.01.0.11. Affected by this vulnerability is the function formSetAccountList of the file /goform/setModules. The manipulation of the argument Password leads to stack-based buffer overflow. The attack can be launched remotely. The...

📄 ollama 0.6.4 Server-Side Request Forgery

ollama versions 0.6.4 and below suffer from a server-side request forgery vulnerability. Exploit Title: ollama 0.6.4 - SSRF Date: 2025-04-03 Exploit Author: sud0 Vendor Homepage: https://ollama.com/ Software Link: https://github.com/ollama/ollama/releases Version: =0.6.4 Tested on: CentOS 8 impor...

Microchip TimeProvider 4100 Grandmaster (Banner Config Modules) 2.4.6 - Stored Cross-Site Scripting (XSS)

Exploit Title: Microchip TimeProvider 4100 Grandmaster Banner Config Modules 2.4.6 - Stored Cross-Site Scripting XSS Exploit Author: Armando Huesca Prida Discovered By: Armando Huesca Prida, Marco Negro, Antonio Carriero, Vito Pistillo, Davide Renna, Manuel Leone, Massimiliano Brolli Date of...

Ivanti Connect Secure CVE-2025-22457 exploited in the wild

On Thursday, April 3, 2025, Ivanti disclosed a critical severity vulnerability affecting Ivanti Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateways. CVE-2025-22457 is a stack-based buffer overflow vulnerability that allows remote, unauthenticated attackers to execute code on the...

Wyse Management Suite Information Disclosure Vulnerability

Wyse Management Suite is a software solution from Dell for managing and monitoring client devices and virtual desktop infrastructures. An information disclosure vulnerability exists in Wyse Management Suite. The vulnerability results in the disclosure of sensitive information due to a data query...

CVE-2025-31765 WordPress GDPR Cookie Notice plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR Cookie Notice: from n/a through = 1.2.0...

Rockwell Automation Lifecycle Services with Veeam Backup and Replication

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker with administrative privileges to execute code on the target system. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...

CVE-2025-24852

Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini IB-MCT001 all versions. If this issue is exploited, an attacker who can access the microSD card used on the product may obtain the product login password...

NVIDIA Container Toolkit 1.16.1 Breakout

NVIDIA Container Toolkit versions 1.16.1 and below contain a Time-of-check Time-of-Use TOCTOU vulnerability when used with a default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful...

Google gVisor elevation of privilege vulnerability (CNVD-2025-07534)

Google gVisor is a container sandboxing technology developed by Google to provide greater isolation and security for containers. An elevation of privilege vulnerability exists in Google gVisor, which can be exploited by an attacker to access restricted files...

CVE-2025-2860

SaTECH BCU in its firmware version 2.1.3, allows an authenticated attacker to access information about the credentials that users have within the web .xml file. In order to exploit this vulnerability, the attacker must know the path, regardless of the user's privileges on the website...

PT-2025-13517 · Arteche · Satech Bcu

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: An attacker with access to the network where the vulnerable device is located could capture traffic and obtain cookies from the user, allowing them to steal a user's active session and make...

SAP CRM and SAP S/4HANA server-side request forgery vulnerability (CNVD-2025-07595)

SAP CRM and SAP S/4HANA are both products of SAP, a customer relationship management system, and SAP S/4HANA, an enterprise resource management software based on the SAP HANA in-memory database system. SAP CRM and SAP S/4HANA suffer from a server-side request forgery vulnerability, which stems fr...

LibreChat Improper Access Control Vulnerability

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from an Improper Access Control vulnerability that can be exploited by an attacker to corrupt application logic and permissions and allow unauthorized operations...

Exploit for CVE-2025-30208

CVE-2025-30208-EXP A vulnerability in Vite’s server’s arbitr...

Eramba Remote Code Execution

This Metasploit module exploits a remote code execution vulnerability in Eramba. An authenticated user can execute arbitrary commands on the server by exploiting the path parameter in the download-test-pdf endpoint. Eramba debug mode has to be enabled. Versions up to 3.19.1 are affected. This...