What needs attention now.

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

• CWE-506

Botslab G980H Dashcams Insufficient Verification of Data Authenticity

• Botslab G980H
• CWE-345

DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution

• Authentication bypass
• CWE-346

<0.22.5 · fixed in 0.22.5

http4s-scala-xml has an XML External Entity (XXE) processing issue

• XML external entities (XXE)

<0.24.1 · fixed in 0.24.1

Improper certificate validation in Eufy Omni C20

• Eufy Omni C20
• Weak cryptography or TLS

OS command injection in Eufy Omni C20, Omni X10 Pro

• Eufy Omni C20
• Eufy Omni X10 Pro
• Command injection

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

• Broken access control

<=1.6.0 · no fixed version yet

Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

• Other injection

<1.1.17 · fixed in 1.1.17

Unauthenticated Sensitive Data Disclosure in ServiceNow AI Platform

• ServiceNow AI Platform
• Broken access control

Unauthenticated SQL Injection in ServiceNow AI Platform

• ServiceNow AI Platform
• SQL injection

Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

• Honeywell PD45 Industrial Printer
• Command injection
• Authentication bypass

RDMA/rtrs-srv: Fix integer underflow in process_read and process_write

• Linux kernel

Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email

• Termix
• Command injection

Dokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root

• dokploy
• Command injection

svcrdma: Reject Write/Reply chunks with segcount 0

• Linux kernel

SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry

• Linux kernel

SunEditor: Critical XSS vulnerability - sanitizer bypass

• Cross-site scripting (XSS)

<2.47.11 · fixed in 2.47.11

In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header.

• OpenStack Zaqar
• CWE-348

DataStage on Cloud Pak for Data has several vulnerabilities

• IBM DataStage on Cloud Pak for Data
• Server-side request forgery (SSRF)

Authentication bypass in PortSwigger Burp Suite DAST

• PortSwigger Burp Suite DAST
• Authentication bypass

HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine

• rejetto hfs2
• Broken access control

HFS2 2.4.0 RCE via Multipart Upload Filename Template Injection

• rejetto hfs2
• Code injection

Improper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy

• Weak cryptography or TLS

>=0.1.2, <0.1.3 · fixed in 0.1.3

Velociraptor Investigator reaches SuperUser via hunt EffectivePrincipal

• Rapid7 Velociraptor
• CWE-164
• CWE-1269

Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

• visualcomposer Visual Composer Website Builder
• File inclusion

Path Traversal in DIAEnergie

• Deltaww DIAEnergie
• Path traversal

Authentication Bypass in DIAEnergie

• Deltaww DIAEnergie
• Authentication bypass

D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write

• D-Link DIR-825
• Memory corruption

SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

• signoz
• CWE-1188

Paytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter

• paytiumsupport Paytium: Mollie payment forms & donations
• Privilege escalation

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().

• Memory corruption

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.

• Memory corruption

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms.

• Memory corruption

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function

• Weak cryptography or TLS

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header

• Server-side request forgery (SSRF)

Double Free in GitLab

• GitLab
• Memory corruption

Integer Overflow or Wraparound in GitLab

• GitLab
• Memory corruption

Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload

• plank laravel-mediable
• Unrestricted file upload

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Memory corruption

RabbitMQ: Trust-store whitelist by Issuer+Serial only

• rabbitmq-server
• Weak cryptography or TLS

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Memory corruption

Multiple Vulnerabilities in IBM Concert Software

• IBM Concert
• Command injection

RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

• rabbitmq-server
• Weak cryptography or TLS

Execution with unnecessary privileges in WebPros cPanel

• WebPros cPanel
• Privilege escalation

Argument injection in WebPros WP Toolkit for cPanel

• WebPros WP Toolkit for cPanel
• Command injection

OS command injection in WebPros Plesk extension "Site Import"

• WebPros Plesk extension "Site Import"
• Command injection

Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Broken access control

Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• CWE-184

s2s-proxy accepts untrusted client certificates

• Temporal Technologies, Inc. s2s-proxy
• CWE-296

OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

• Code injection

>=5.1.0, <7.3.0 · fixed in 7.3.0

Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Command injection

Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioni…

• Red Hat Ansible Automation Platform 2.4 for RHEL 8
• Red Hat Ansible Automation Platform 2.4 for RHEL 9
• CWE-807

WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability

• WBW Plugins Product Filter by WBW
• SQL injection

Insecure direct object reference in Claris FileMaker Server

• Claris FileMaker Server
• Broken access control

Out-of-bounds read in Claris FileMaker Server

• Claris FileMaker Server
• Memory corruption

orval before 8.29.0 Code Injection via operationId

• orval
• Code injection

orval @orval/core before 8.28.0 Code Injection via Form-Data

• orval
• Code injection

orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

• orval
• Code injection

orval before 8.30.0 Code Injection via Factory Generation

• orval
• Code injection

orval @orval/effect 8.14.0 through 8.28.1 Code Injection

• orval
• Code injection