CVE-2025-12055

MPDV Mikrolab HYDRA X, MIP 2 and FEDRA 2 are affected by an unauthenticated local file disclosure bug up to Maintenance Pack 36 with Servicepack 8 (week 36/2025). The issue stems from improper validation of the Filename parameter in the public $SCHEMAS$ resource, allowing an attacker to read arbi...

MPDV Mikrolab多款产品 安全漏洞

MPDV Mikrolab HYDRA X and others are products of MPDV Mikrolab, Germany.MPDV Mikrolab HYDRA X is a platform-based manufacturing execution system.MPDV Mikrolab MIP 2 is an industrial manufacturing integration platform.MPDV Mikrolab FEDRA 2 is an industrial manufacturing integration MPDV Mikrolab...

GitLab Enterprise Edition 安全漏洞

GitLab Enterprise Edition EE is a content management system from GitLab, Inc. in the United States. A security vulnerability exists in GitLab Enterprise Edition version 18.4 up to and including version 18.4.3 and version 18.5 up to and including version 18.5.1, which stems from a flaw in the acce...

PT-2025-43887

Name of the Vulnerable Software and Affected Versions HYDRA X, MIP 2, and FEDRA 2 versions prior to Maintenance Pack 36 with Servicepack 8 week 36/2025 Description HYDRA X, MIP 2, and FEDRA 2 are affected by a local file disclosure issue. An unauthenticated attacker can read arbitrary files from...

Security update for chrony

This update for chrony fixes the following issues: Race condition during socket creation by chronyc allows privilege escalation from user chrony to root bsc1246544. This update also ships chrony-pool-empty to SLE Micro 5.x jscSMO-587 Patch Instructions: To install this SUSE update use the SUSE...

Baohuo Android Malware Hijacks Telegram Accounts via Fake Telegram X

New Android malware Baohuo hijacks Telegram X accounts, stealing data and controlling chats. Over 58,000 devices infected, mainly in India and Brazil...

Authentik < 2024.6.5 Authentication Bypass

According to its banner, the version of Authentik running on the remote host is prior to 2024.6.5 or 2024.8.x prior to 2024.8.3. It is, therefore, affected by an Authentication Bypass vulnerability via the X-Forwarded-For header. Note that the scanner has not tested for these issues but has inste...

Atlassian Confluence 2.x < 8.5.25 Denial of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 2.x prior to 8.5.25, 9.2.x prior to 9.2.7 or 10.x prior to 10.0.2. It is, therefore, affected by a denial of service vulnerability. Note that the scanner has not tested for these issu...

Authentik 2024.8.x < 2024.8.3 Authentication Bypass

According to its banner, the version of Authentik running on the remote host is prior to 2024.6.5 or 2024.8.x prior to 2024.8.3. It is, therefore, affected by an Authentication Bypass vulnerability via the X-Forwarded-For header. Note that the scanner has not tested for these issues but has inste...

CVE-2025-62061

Cross-Site Request Forgery CSRF vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through = 1.8.4...

Oracle Primavera Gateway (October 2025 CPU)

The versions of Primavera Gateway installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin Apache Commons VFS. Supported versions...

CVE-2025-40778

Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through...

CVE-2025-62061

Cross-Site Request Forgery CSRF vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through = 1.8.4...

CVE-2025-49916

Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through = 4.2.23...

CVE-2025-11966

In Eclipse Vert.x versions 4.0.0, 4.5.21 and 5.0.0, 5.0.4, when "directory listing" is enabled, file and directory names are inserted into generated HTML without proper escaping in the href, title, and link attributes. An attacker who can create or rename files or directories within a served path...

CVE-2025-62061 WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through = 1.8.4...

CVE-2025-62061

CVE-2025-62061 is a CSRF vulnerability in the WordPress plugin Product Catalog Simple (post-type-x) affecting versions up to 1.8.4. Public listings show CVSSv3.1 base score 4.3 (Medium) with minimal impact: confidentiality low, integrity/availability none, requiring user interaction for exploitat...

Golang 1.24.x < 1.24.8 / 1.25.x < 1.25.2 Multiple Vulnerabilities (qZN5nc-mBgAJ)

The version of Golang running on the remote host is 1.24.x prior to 1.24.8, 1.25.x prior to 1.25.2. It is, therefore, affected by multiple vulnerabilities as referenced in qZN5nc-mBgAJ advisory. - The Parse function permitted values other than IPv6 addresses to be included in square brackets with...

TencentOS Server 4: tigervnc (TSSA-2025:0761)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2025:0761 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

Oracle MySQL Server <= 8.0.43, 8.1.x <= 8.4.7, 9.0.0 <= 9.4.0 Security Update (cpuoct2025) - Linux

Oracle MySQL Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:mysql"; if...