CVE-2025-34291

Summary: Langflow AI

CVE-2025-66644

CVE-2025-66644 affects Array Networks ArrayOS AG before 9.4.5.9, with an OS command injection vulnerability that could allow an attacker to execute arbitrary commands. Exploitation has been observed in the wild between August and December 2025, impacting ArrayOS AG versions up to 9.4.5.8. Remedia...

CVE-2025-55182

CVE-2025-55182 is a pre-auth remote code execution vulnerability in React Server Components (versions 19.0.0, 19.1.0, 19.1.1, 19.2.0) affecting react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The issue arises from unsafe deserialization of payloads in HTTP reque...

CVE-2025-13390

CVE-2025-13390 affects the WordPress plugin WP Directory Kit, versions up to 1.4.4. The flaw is an authentication bypass caused by a weak token generation in the wdk_generate_auto_login_link function, making tokens predictable and allowing unauthenticated attackers to gain administrative access a...

CVE-2025-13342

The CVE-2025-13342 flaw affects the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.28.20). Root cause: ActionOptions::run() save handler lacks proper capability checks and input validation, allowing unauthenticated users to modify WordPress options (e.g., users_can_...

CVE-2025-13486

The CVE-2025-13486 vulnerability affects the Advanced Custom Fields: Extended (ACFE) WordPress plugin, versions 0.9.0.5–0.9.1.1. It arises from the prepare_form() function, where user-supplied data is forwarded to call_user_func_array() without proper validation, enabling unauthenticated remote c...

CVE-2025-55749

XWiki Jetty package (XJetty) exposes a context that allows static access to files under webapp/, leading to information disclosure of potentially credential-bearing files. Affected versions are 16.7.0–16.10.11, 17.4.4, and 17.7.0. The issue is fixed in 16.10.11, 17.4.4, and 17.7.0. Connected data...

CVE-2025-51683

CVE-2025-51683: mJobtime v15.7.2 contains a blind SQL injection in the /Default.aspx/update_profile_Server endpoint. Exploitation is unauthenticated and can lead to arbitrary SQL execution, with high impact on confidentiality, integrity, and availability. The description and sources confirm the v...

CVE-2025-62593

Technical details for CVE-2025-62593 are not publicly disclosed in the provided documents; the Ray RCE entry and related advisories do not contain product/version/impact information for this CVE. Monitor for updates.

CVE-2025-58360

CVE-2025-58360 : GeoServer contains an XML External Entity (XXE) vulnerability in the GetMap operation (/geoserver/wms). The issue arises from insufficient XML input sanitization, allowing external entities to be defined in requests. Affected: GeoServer versions 2.26.0–2.26.1 and 2.25.0–2.25.5 (i...

CVE-2025-6389

The CVE-2025-6389 issue affects the WordPress Sneeit Framework plugin (versions

CVE-2023-7330

CVE-2023-7330 affects Ruijie NBR series routers. An unauthenticated arbitrary file upload vulnerability exists via /ddi/server/fileupload.php where attacker-controlled values in the name and uploadDir parameters are accepted and the multipart file content is saved without proper validation or san...

CVE-2024-14007

The CVE-2024-14007 entry affects Shenzhen TVT NVMS-9000 firmware prior to 1.3.4. A flaw in the NVMS-9000 control protocol allows an unauthenticated remote attacker to bypass authentication by sending a crafted TCP payload to an exposed control port, enabling privileged administrative query comman...

CVE-2018-25126

CVE-2018-25126 affects Shenzhen TVT NVMS-9000 firmware, used in many white-labeled DVR/NVR/IPC products. The issue arises from hardcoded API credentials and an OS command injection flaw in the configuration services: the web/API interface accepts HTTP/XML requests authenticated with a fixed vendo...

CVE-2025-11368

The CWE/CVE entry CVE-2025-11368 maps to the LearnPress WordPress LMS Plugin. Affected versions are up to 4.2.9.4 (and versions prior to 4.2.9.5 as per PT-2025-47660). The root cause is missing capability checks in the REST endpoint /wp-json/lp/v1/load_content_via_ajax, enabling arbitrary callbac...

CVE-2025-40601

The CVE-2025-40601 entry affects SonicOS SSLVPN and is characterized by a stack-based buffer overflow in the SSLVPN service that allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) and potentially crash the affected firewall. Public docs identify this as a pre-auth, net...

CVE-2025-11001

CVE-2025-11001 affects 7-Zip

CVE-2025-13315

CVE-2025-13315 affects Twonky Server 8.5.2 on Linux and Windows. An unauthenticated attacker can bypass the web service API authentication, access protected endpoints, and leak a log file containing the administrator’s username and encrypted password. Related CVE-2025-13316 describes a cryptograp...

CVE-2025-64764

Astro (web framework) prior to 5.15.8 is affected by a reflected XSS via the server islands feature. The root cause is improper handling of the server islands endpoint, allowing a payload to be reflected and executed in the user’s browser. The issue is fixed in version 5.15.8 and later. Public pr...

CVE-2025-12057

CVE-2025-12057 affects the WavePlayer WordPress plugin prior to version 3.8.0. The vulnerability arises from missing authorization in an AJAX action and lack of validation when copying files locally, allowing unauthenticated users to upload arbitrary files to the server and potentially achieve re...