The service wmp-agent of KerOS prior 5.12 does not properly validate so-called ‘magic URLs’ allowing an unauthenticated remote attacker to execute arbitrary OS commands as root when the service is reachable over network. Typically, the service is protected via local firewall. CVSSv3.1 8.1 (HIGH) · EPSS 43th percentile
Insufficient argument validation in OpenVPN 2.7_alpha1 through 2.7_rc1 allows an attacker to trigger a heap buffer over-read when parsing IP addresses CVSSv3.1 9.1 (CRITICAL) · EPSS 45th percentile
A vulnerability was found in ADSLR NBR1005GPEV2 250814-r037c. This issue affects the function set_mesh_disconnect of the file /send_order.cgi. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 6.3 (MEDIUM) · EPSS 95th percentile
A vulnerability has been found in ADSLR NBR1005GPEV2 250814-r037c. This vulnerability affects the function ap_macfilter_del of the file /send_order.cgi. The manipulation of the argument mac leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSSv3.1 6.3 (MEDIUM) · EPSS 95th percentile
The StreamTube Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 4.78. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts. Note: This can only be exploited if the 'registration password fields' enabled in theme CVSSv3.1 9.8 (CRITICAL) · EPSS 29th percentile
Nuclei-templates v10.3.3 released with automated checksum generation. This is a routine maintenance release of the ProjectDiscovery template library used for vulnerability scanning.
AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-catcher. This vulnerability allows an attacker to write approximately 1KB of arbitrary data into a 128-byte buffer. This issue has been patched in version 0.64. CVSSv3.1 9.8 (CRITICAL) · EPSS 41th percentile
willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitmerge. The vulnerability manifests in this package due to the use of insecure child process execution API (exec) to which it concatenates user input, whether provided to the command-line flag, or is in user control in the target repository. At time of publication, no known fix is public. CVSSv3.1 9.8 (CRITICAL) · EPSS 85th percentile
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It could be used by an authenticated user with access to this feature to access URLs only accessible to the LibreChat server (such as cloud metadata services, through which impersonation of the server might be possible). This is CVSSv3.1 8.1 (HIGH) · EPSS 20th percentile
PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to upload packages as any user by providing arbitrary author-id values. This enables identity spoofing, privilege escalation, and supply chain attacks. This issue has been patched in version 1.1.3. CVSSv3.1 9.4 (CRITICAL) · EPSS 40th percentile
Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. CVSSv3.1 8.0 (HIGH) · EPSS 0th percentile
An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) information to li-admin users. This can lead to privilege escalation. CVSSv3.1 8.8 (HIGH) · EPSS 20th percentile
Shai-hulud 2.0 is an active supply-chain worm targeting NPM package maintainers, stealing credentials from AWS/GCP/Azure, GitHub tokens, and NPM authentication, then automatically backdooring all victim-maintained packages with malicious payloads. The malware establishes C&C via GitHub Actions workflows and self-hosted runners, enabling command execution and secret exfiltration at scale across the NPM ecosystem. Hundreds of repositories were compromised in a November 24 incident, with the worm capable of exponential propagation to downstream users.
Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability exploitable via Firefox and Safari. This vulnerability is due to an insufficient guard against browser-based attacks, as the current defense uses the User-Agent header starting with the string "Mozilla" as a defense mechanism. This defense is insufficient as the fetch specification allows the User-Agent header to be modified CVSSv3.1 8.8 (HIGH) · EPSS 30th percentile
An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary user accounts. CVSSv3.1 9.8 (CRITICAL) · EPSS 35th percentile
An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication checks, bypassing the expected admin-only deletion restriction. CVSSv3.1 9.1 (CRITICAL) · EPSS 40th percentile
Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser. CVSSv3.1 9.8 (CRITICAL) · EPSS 58th percentile
An issue in the cms_rest.php component of SIGB PMB v8.0.1.14 allows attackers to execute arbitrary code via unserializing an arbitrary file. CVSSv3.1 9.8 (CRITICAL) · EPSS 38th percentile
A Heap-based Buffer Overflow vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 31th percentile
An Out-of-Bounds Write vulnerability is present in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions 12.6.1204.216 and prior that could allow an attacker to disclose information or execute arbitrary code. CVSSv3.1 9.8 (CRITICAL) · EPSS 37th percentile
SpecterOps released RelayInformer, a Python tool and Cobalt Strike BOF suite that enumerates Extended Protection for Authentication (EPA) enforcement across MSSQL, HTTP/S, and LDAPS services. The research demonstrates methodologies for detecting all three EPA enforcement levels (Disabled, Allowed/When Supported, Required) by manipulating NTLM AV pairs and analyzing server responses, enabling attackers to determine relay feasibility before investing in coercion and tunneling infrastructure.
watchTowr researchers discovered 80,000+ saved JSON/code snippets on public formatter websites (JSONFormatter.org, CodeBeautify.org) containing thousands of exposed secrets including Active Directory credentials, API keys, cloud environment keys, private keys, and sensitive PII from critical infrastructure, government, finance, banking, and cybersecurity organizations. The researchers exploited trivial enumeration of sequential IDs and public "Recent Links" pages to systematically extract credentials, database passwords, CI/CD pipeline tokens, and full KYC banking data across a 5-year historical window.
Improper input validation within the XOCL driver may allow a local attacker to generate an integer overflow condition, potentially resulting in loss of confidentiality or availability. CVSSv3.1 8.0 (HIGH) · EPSS 2th percentile
Cross-Site Request Forgery (CSRF) vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa account to a victim's Tuya account. The applications fail to validate the OAuth state parameter during the account linking flow, enabling a cross-site request forgery (CSRF)-like attack. CVSSv3.1 8.8 (HIGH) · EPSS 3th percentile
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls. CVSSv3.1 8.2 (HIGH) · EPSS 30th percentile