PT-2025-23656 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function gmm state authentication/emm state authentication of the component AMF/MME. The manipulation leads to reachable assertion. It is possible to launch the attack...

PT-2025-23677

Name of the Vulnerable Software and Affected Versions Deno versions 1.46.0 through 2.1.6 Description The issue affects AES-256-GCM and AES-128-GCM in Deno, where the authentication tag is not being validated. This means tampered ciphertexts or incorrect keys might not be detected, which breaks th...

PT-2025-23883 · D Link · D-Link Dir-816

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 version 1.10CNB05 Description: A critical issue has been discovered, affecting the /goform/form2lansetup.cgi file. The manipulation of the ip argument leads to a stack-based buffer overflow. This issue can be initiated remotely...

UBUNTU-CVE-2025-48387

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

CVE-2025-48387

Summary of CVE-2025-48387 (tar-fs) : A path-traversal risk in tar-fs bindings for tar-stream affects releases prior to 3.0.9, 2.1.3, and 1.16.5, where extracting certain tarballs can write outside the intended directory. The issue has been fixed in 3.0.9, 2.1.3, and 1.16.5. As a workaround, you c...

CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...

AZL-62229 CVE-2025-48866 affecting package mod_security 2.9.4-1

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

CVE-2025-48866 ModSecurity has possible DoS vulnerability in sanitiseArg action

ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg - this is the same action but an alias is...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

CVE-2025-48957 AstrBot Has Path Traversal Vulnerability in /api/chat/get_file

AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to information disclosure, such as API keys for LLM providers, account passwords, and other sensitive data. The vulnerability has been addressed in...

PT-2025-23503 · Linksys · Linksys Re6300 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001 Description: A critical issue has been found, affecting the function RP pingGatewayByBBS of the file /goform/RP pingGatewayByBBS. The...

PT-2025-23528

Name of the Vulnerable Software and Affected Versions catdoc version 0.95 Description An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality. A specially crafted malformed file can lead to heap-based memory corruption. An attacker can provide a malicious file to...

PT-2025-23489 · Linksys · Linksys Re9000 +5

Name of the Vulnerable Software and Affected Versions: Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 versions 1.0.013.001 through 1.2.07.001 Description: A critical vulnerability has been found in the Linksys RE-series range extenders. This affects the NTP function of the file...

PT-2025-23465 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue was found in the software. It affects an unknown function of the file /department-profile.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23475 · Unknown · Aem Solutions Cms

Name of the Vulnerable Software and Affected Versions: Aem Solutions CMS versions up to 1.0 Description: A critical issue affects an unknown part of the file /page.php. The manipulation of the ID argument leads to sql injection. It is possible to initiate the attack remotely. The vendor was...

PT-2025-23496 · Unknown · Ce Phoenix

Name of the Vulnerable Software and Affected Versions: CE Phoenix versions 1.0.9.9 through 1.1.0.2 Description: A stored cross-site scripting XSS issue was found in CE Phoenix, where an attacker can inject malicious JavaScript into the testimonial description field. If the shop owner approves the...

ModSecurity -- possible DoS vulnerability

[email protected] reports: ModSecurity is an open source, cross platform web application firewall WAF engine for Apache, IIS and Nginx. Versions prior to 2.9.10 contain a denial of service vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The sanitiseArg and sanitizeArg -...

PT-2025-23471 · Unknown · Assamlook Cms

Name of the Vulnerable Software and Affected Versions: AssamLook CMS version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file /view tender.php. The manipulation of the ID argument leads to SQL injection. This issue can be exploited...

PT-2025-23550 · Weblaudos · Weblaudos

Name of the Vulnerable Software and Affected Versions: WebLaudos version 24.2 04 Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information via the id parameter. This enables the attacker to access confidential data. Recommendations: For WebLaudos version 24...