| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-7465 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2025 | A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer… | ||
| CVE-2025-7464 | Low | 0.24 | 3.7 | 0.00 | Jul 12, 2025 | A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is… | ||
| CVE-2025-7463 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2025 | A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP POST Request Handler. The manipulation of the argument mit_ssid leads to buffer… | ||
| CVE-2025-7462 | Med | 0.28 | 4.3 | 0.00 | Jul 12, 2025 | A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation… | ||
| CVE-2025-1313 | Hig | 0.57 | 8.8 | 0.00 | Jul 12, 2025 | The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email… | ||
| CVE-2025-7461 | Hig | 0.47 | 7.3 | 0.00 | Jul 12, 2025 | A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument proId leads to sql injection. The attack may be launched remotely. The exploit has… | ||
| CVE-2025-6058 | Cri | 0.64 | 9.8 | 0.06 | Jul 12, 2025 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated… | ||
| CVE-2025-6057 | Hig | 0.57 | 8.8 | 0.01 | Jul 12, 2025 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and… | ||
| CVE-2025-24294 | Hig | 0.42 | 7.5 | 0.01 | Jul 12, 2025 | The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the… | ||
| CVE-2024-38648 | Med | 0.37 | 5.7 | 0.01 | Jul 12, 2025 | A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials. | ||
| CVE-2023-39339 | Med | 0.32 | 4.9 | 0.01 | Jul 12, 2025 | A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request. | ||
| CVE-2023-39338 | Med | 0.44 | 6.8 | 0.01 | Jul 12, 2025 | Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access. | ||
| CVE-2023-38036 | Cri | 0.64 | 9.8 | 0.03 | Jul 12, 2025 | A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution. | ||
| CVE-2025-53879 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53878 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53877 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53876 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53875 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53874 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53873 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53872 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-53871 | — | 0.00 | — | — | Jul 12, 2025 | Rejected reason: Not used | ||
| CVE-2025-5199 | Hig | 0.00 | 7.3 | 0.00 | Jul 12, 2025 | In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup. | ||
| CVE-2025-7460 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2025 | A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads… | ||
| CVE-2025-53636 | Med | 0.28 | 5.4 | 0.00 | Jul 11, 2025 | Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and… | ||
| CVE-2025-7459 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2025 | A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been… | ||
| CVE-2025-7457 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2025 | A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the file /admin/manage_movie.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate… | ||
| CVE-2025-7456 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2025 | A vulnerability, which was classified as critical, has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this issue is some unknown functionality of the file /reserve.php. The manipulation of the argument ID leads to sql injection. The attack… | ||
| CVE-2025-7455 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2025 | A vulnerability classified as critical was found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_reserve.php. The manipulation of the argument mid leads to sql injection. The attack can… | ||
| CVE-2025-7503 | Cri | 0.65 | — | 0.01 | Jul 11, 2025 | An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user… | ||
| CVE-2025-7454 | Hig | 0.47 | 7.3 | 0.00 | Jul 11, 2025 | A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the file /admin/manage_theater.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the… | ||
| CVE-2025-7453 | Low | 0.17 | 3.7 | 0.00 | Jul 11, 2025 | A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use… | ||
| CVE-2025-3631 | Med | 0.42 | 6.5 | 0.00 | Jul 11, 2025 | An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it. | ||
| CVE-2025-30403 | Hig | 0.46 | 8.1 | 0.00 | Jul 11, 2025 | A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00. | ||
| CVE-2013-3307 | Hig | 0.62 | 8.3 | 0.63 | Jul 11, 2025 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000. | ||
| CVE-2025-7452 | Med | 0.41 | 6.3 | 0.00 | Jul 11, 2025 | A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the… | ||
| CVE-2025-53642 | Med | 0.31 | 4.8 | 0.00 | Jul 11, 2025 | haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6. | ||
| CVE-2025-53641 | Hig | 0.46 | 8.2 | 0.00 | Jul 11, 2025 | Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to… | ||
| CVE-2025-30402 | Hig | 0.46 | 8.1 | 0.00 | Jul 11, 2025 | A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f | ||
| CVE-2025-7450 | Med | 0.35 | 5.4 | 0.00 | Jul 11, 2025 | A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is… | ||
| CVE-2025-47964 | Med | 0.35 | 5.4 | 0.00 | Jul 11, 2025 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||
| CVE-2025-47963 | Med | 0.41 | 6.3 | 0.01 | Jul 11, 2025 | No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||
| CVE-2025-47182 | Med | 0.36 | 5.6 | 0.00 | Jul 11, 2025 | Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2025-45582 | Med | 0.27 | 4.1 | 0.00 | Jul 11, 2025 | GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a… | ||
| CVE-2025-43856 | Hig | 0.40 | — | 0.00 | Jul 11, 2025 | immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, so when the user… | ||
| CVE-2024-47065 | Med | 0.42 | 6.5 | 0.00 | Jul 11, 2025 | Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and… | ||
| CVE-2025-7029 | Hig | 0.53 | 8.2 | 0.00 | Jul 11, 2025 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing… | ||
| CVE-2025-7028 | — | Hig | 0.51 | 7.8 | 0.00 | Jul 11, 2025 | A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash,… | |
| CVE-2025-7027 | Hig | 0.53 | 8.2 | 0.00 | Jul 11, 2025 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write… | ||
| CVE-2025-7026 | — | Hig | 0.53 | 8.2 | 0.00 | Jul 11, 2025 | A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., '$DB$' or '2DB$'), the function… |
- risk 0.57cvss 8.8epss 0.01
A vulnerability classified as critical was found in Tenda FH1201 1.2.0.14. Affected by this vulnerability is the function fromRouteStatic of the file /goform/fromRouteStatic of the component HTTP POST Request Handler. The manipulation of the argument page leads to buffer…
- risk 0.24cvss 3.7epss 0.00
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is…
- risk 0.57cvss 8.8epss 0.01
A vulnerability was found in Tenda FH1201 1.2.0.14. It has been declared as critical. This vulnerability affects the function formWrlsafeset of the file /goform/AdvSetWrlsafeset of the component HTTP POST Request Handler. The manipulation of the argument mit_ssid leads to buffer…
- risk 0.28cvss 4.3epss 0.00
A vulnerability was found in Artifex GhostPDL up to 3989415a5b8e99b9d1b87cc9902bde9b7cdea145. It has been classified as problematic. This affects the function pdf_ferror of the file devices/vector/gdevpdf.c of the component New Output File Open Error Handler. The manipulation…
- risk 0.57cvss 8.8epss 0.00
The Nokri - Job Board WordPress Theme theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.6.3. This is due to the plugin not properly validating a user's identity prior to updating their details like email…
- risk 0.47cvss 7.3epss 0.00
A vulnerability was found in code-projects Modern Bag 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /action.php. The manipulation of the argument proId leads to sql injection. The attack may be launched remotely. The exploit has…
- risk 0.64cvss 9.8epss 0.06
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated…
- risk 0.57cvss 8.8epss 0.01
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and…
- risk 0.42cvss 7.5epss 0.01
The attack vector is a potential Denial of Service (DoS). The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS packet. An attacker can craft a malicious DNS packet containing a highly compressed domain name. When the…
- risk 0.37cvss 5.7epss 0.01
A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.
- risk 0.32cvss 4.9epss 0.01
A vulnerability exists on all versions of Ivanti Policy Secure below 22.6R1 where an authenticated administrator can perform an arbitrary file read via a maliciously crafted web request.
- risk 0.44cvss 6.8epss 0.01
Enables an authenticated user (enrolled device) to access a service protected by Sentry even if they are not authorized according to the sentry policy to access that service. It does not enable the user to authenticate to or use the service, it just provides the tunnel access.
- risk 0.64cvss 9.8epss 0.03
A security vulnerability within Ivanti Avalanche Manager before version 6.4.1 may allow an unauthenticated attacker to create a buffer overflow that could result in service disruption or arbitrary code execution.
- CVE-2025-53879Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53878Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53877Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53876Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53875Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53874Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53873Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53872Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- CVE-2025-53871Jul 12, 2025risk 0.00cvss —epss —
Rejected reason: Not used
- risk 0.00cvss 7.3epss 0.00
In Canonical Multipass up to and including version 1.15.1 on macOS, incorrect default permissions allow a local attacker to escalate privileges by modifying files executed with administrative privileges by a Launch Daemon during system startup.
- risk 0.57cvss 8.8epss 0.01
A vulnerability has been found in TOTOLINK T6 4.1.5cu.748_B20211015 and classified as critical. Affected by this vulnerability is the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component HTTP POST Request Handler. The manipulation of the argument mac leads…
- risk 0.28cvss 5.4epss 0.00
Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service (DoS) to the ondemand system. This vulnerability is fixed in 3.1.14 and…
- risk 0.47cvss 7.3epss 0.00
A vulnerability classified as critical was found in code-projects Mobile Shop 1.0. This vulnerability affects unknown code of the file /EditMobile.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been…
- risk 0.47cvss 7.3epss 0.00
A vulnerability, which was classified as critical, was found in Campcodes Online Movie Theater Seat Reservation System 1.0. This affects an unknown part of the file /admin/manage_movie.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate…
- risk 0.47cvss 7.3epss 0.00
A vulnerability, which was classified as critical, has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this issue is some unknown functionality of the file /reserve.php. The manipulation of the argument ID leads to sql injection. The attack…
- risk 0.47cvss 7.3epss 0.00
A vulnerability classified as critical was found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_reserve.php. The manipulation of the argument mid leads to sql injection. The attack can…
- risk 0.65cvss —epss 0.01
An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s web interface or user…
- risk 0.47cvss 7.3epss 0.00
A vulnerability classified as critical has been found in Campcodes Online Movie Theater Seat Reservation System 1.0. Affected is an unknown function of the file /admin/manage_theater.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the…
- risk 0.17cvss 3.7epss 0.00
A vulnerability was found in saltbo zpan up to 1.6.5/1.7.0-beta2. It has been rated as problematic. This issue affects the function NewToken of the file zpan/internal/app/service/token.go of the component JSON Web Token Handler. The manipulation with the input 123 leads to use…
- risk 0.42cvss 6.5epss 0.00
An IBM MQ 9.3 and 9.4 Client connecting to an MQ Queue Manager can cause a SIGSEGV in the AMQRMPPA channel process terminating it.
- risk 0.46cvss 8.1epss 0.00
A heap-buffer-overflow vulnerability is possible in mvfst via a specially crafted message during a QUIC session. This issue affects mvfst versions prior to v2025.07.07.00.
- risk 0.62cvss 8.3epss 0.63
Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.
- risk 0.41cvss 6.3epss 0.00
A vulnerability was found in kone-net go-chat up to f9e58d0afa9bbdb31faf25e7739da330692c4c63. It has been declared as critical. This vulnerability affects the function GetFile of the file go-chat/api/v1/file_controller.go of the component Endpoint. The manipulation of the…
- risk 0.31cvss 4.8epss 0.00
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not terminate a user's session or clear their cookies. Additionally, the application issues a refresh token when logging out. This vulnerability is fixed in 11.0.6.
- risk 0.46cvss 8.2epss 0.00
Postiz is an AI social media scheduling tool. From 1.45.1 to 1.62.3, the Postiz frontend application allows an attacker to inject arbitrary HTTP headers into the middleware pipeline. This flaw enables a server-side request forgery (SSRF) condition, which can be exploited to…
- risk 0.46cvss 8.1epss 0.00
A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f
- risk 0.35cvss 5.4epss 0.00
A vulnerability was found in letseeqiji gorobbs up to 1.0.8. It has been classified as critical. This affects the function ResetUserAvatar of the file controller/api/v1/user.go of the component API. The manipulation of the argument filename leads to path traversal. It is…
- risk 0.35cvss 5.4epss 0.00
Microsoft Edge (Chromium-based) Spoofing Vulnerability
- risk 0.41cvss 6.3epss 0.01
No cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
- risk 0.36cvss 5.6epss 0.00
Improper input validation in Microsoft Edge (Chromium-based) allows an authorized attacker to bypass a security feature locally.
- risk 0.27cvss 4.1epss 0.00
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a…
- risk 0.40cvss —epss 0.00
immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, so when the user…
- risk 0.42cvss 6.5epss 0.00
Meshtastic is an open source mesh networking solution. Prior to 2.5.1, traceroute responses from the remote node are not rate limited. Given that there are SNR measurements attributed to each received transmission, this is a guaranteed way to get a remote station to reliably and…
- risk 0.53cvss 8.2epss 0.00
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used to derive pointers (OcHeader, OcData) passed into power and thermal configuration logic. These buffers are not validated before performing…
- risk 0.51cvss 7.8epss 0.00
A vulnerability in the Software SMI handler (SwSmiInputValue 0x20) allows a local attacker to supply a crafted pointer (FuncBlock) through RBX and RCX register values. This pointer is passed unchecked into multiple flash management functions (ReadFlash, WriteFlash, EraseFlash,…
- risk 0.53cvss 8.2epss 0.00
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control both the read and write addresses used by the CommandRcx1 function. The write target is derived from an unvalidated UEFI NVRAM variable (SetupXtuBufferAddress), while the write…
- risk 0.53cvss 8.2epss 0.00
A vulnerability in the Software SMI handler (SwSmiInputValue 0xB2) allows a local attacker to control the RBX register, which is used as an unchecked pointer in the CommandRcx0 function. If the contents at RBX match certain expected values (e.g., '$DB$' or '2DB$'), the function…