An issue in the password change function of Silverpeas v6.4.2 and lower allows for the bypassing of password complexity requirements. CVSSv3.1 9.8 (CRITICAL) · EPSS 71th percentile
Elastic Security Labs published a technical deconstruction of BANSHEE Stealer, a macOS-native infostealer malware reportedly developed by Russian threat actors and sold for $3,000/month on underground forums. The malware targets system information, browser credentials (9 browsers + ~100 extensions), cryptocurrency wallets, and keychain data across both x86_64 and ARM64 architectures, using basic evasion (debugger/VM detection, language checks) and credential phishing via fake system dialogs.
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel. CVSSv3.1 9.8 (CRITICAL) · EPSS 100th percentile
An issue in D3D Security D3D IP Camera (D8801) v.V9.1.17.1.4-20180428 allows a local attacker to execute arbitrary code via a crafted payload CVSSv3.1 9.8 (CRITICAL) · EPSS 47th percentile
Incorrect Privilege Assignment vulnerability in WofficeIO Woffice woffice.This issue affects Woffice: from n/a through <= 5.4.10. CVSSv3.1 9.8 (CRITICAL)
The JS Help Desk – The Ultimate Help Desk & Support Plugin plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.8.6 via the 'storeTheme' function. This is due to a lack of sanitization on user-supplied values, which replace values in the style.php file, along with missing capability checks. This makes it possible for unauthenticated attackers to execute code on the server. This issue was partially pa CVSSv3.1 9.8 (CRITICAL)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 45th percentile
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Order Management allows OS Command Injection. This issue affects Veribase Order Management: before v4.010.2. CVSSv3.1 9.8 (CRITICAL) · EPSS 82th percentile
llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561. CVSSv3.1 10.0 (CRITICAL) · EPSS 90th percentile
Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. In versions 3.4.0.M4 through 4.2.0,, the proxy endpoint of openHAB's CometVisu add-on can be accessed without authentication. This proxy-feature can be exploited as Server-Side Request Forgery (SSRF) to induce GET HTTP requests to internal-only servers, in case openHAB is exposed in a non-private network. Furthermore, this proxy-feature can also be exploited CVSSv3.1 10.0 (CRITICAL) · EPSS 60th percentile
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Both of these can requeue the delayed work which wouldn't be canceled by any of the following code in case that happens after cancel_delayed_work_sync() runs -- __close_session() doesn't mess with the delayed work in ord CVSSv3.1 9.8 (CRITICAL)
A select option could partially obscure security prompts. This could be used by a malicious site to trick a user into granting permissions. *This issue only affects Android versions of Firefox.* This vulnerability affects Firefox < 129. CVSSv3.1 8.1 (HIGH) · EPSS 20th percentile
Elastic Security Labs published original research demonstrating multiple bypass techniques against Windows Smart App Control (SAC) and SmartScreen reputation-based protections. The research identifies four attack classes: signed malware, reputation hijacking via script interpreters (Lua, Node.js, AutoHotkey), reputation seeding of benign-appearing binaries, and reputation tampering via fuzzy hashing. A critical finding is an LNK file handling bug in explorer.exe that strips Mark of the Web (MotW) before security checks, allowing arbitrary code execution with no warnings.
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges. CVSSv3.1 9.8 (CRITICAL) · EPSS 74th percentile
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command. CVSSv3.1 9.8 (CRITICAL) · EPSS 55th percentile
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Traffic Injection attack due to improper verification of the source of a communication channel. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform a Drop Encryption Level attack due to the selection of a less-secure algorithm during negotiation. CVSSv3.1 9.1 (CRITICAL) · EPSS 33th percentile
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to perform command line execution through SQL Injection due to improper neutralization of special elements used in an OS command. CVSSv3.1 9.8 (CRITICAL) · EPSS 57th percentile
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 8.5 (HIGH)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 8.0 (HIGH)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CridioStudio ListingPro listingpro-plugin allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through <= 2.9.4. CVSSv3.1 9.0 (CRITICAL)
Elastic Security Labs disclosed BITSLOTH, a previously undocumented Windows backdoor discovered in a June 2024 intrusion against a South American government foreign ministry. The malware leverages Microsoft's Background Intelligent Transfer Service (BITS) for command-and-control communication, employing DLL side-loading via FL Studio for execution and offering 35+ handler functions for discovery, collection (keylogging, screenshots), and lateral movement. Development artifacts and VirusTotal submissions indicate the malware has been in active development since December 2021, with Chinese-language debugging strings suggesting native Chinese-speaking developers.
libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated. This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](h CVSSv3.1 6.5 (MEDIUM) · EPSS 97th percentile
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects. CVSSv3.1 9.8 (CRITICAL) · EPSS 64th percentile