Archive
17 June 2025
Vulnerabilities first published on this day (UTC), newest first.
174 results · Feed
-
Medium 5.3
Dify has XSS vulnerability
Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use website vulnerabilities to inject malicious script code into web pages. This may result in a cross-site…
-
Critical 9.8CVE-2025-49825 Scanner template
Teleport allows remote authentication bypass
Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulnerable to remote authentication bypass. At time of posting, there is no available open-source patch.
-
Medium 6.8
Portainer HTTP Headers May Leak to Malicious Container Registries
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. Prior to STS version 2.31.0 and LTS version 2.27.7, if a Portainer administrator c…
-
High 7.8
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that co…
-
High 7.8
Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that co…
-
Low 1.7
conda-smithy Insecure Encryption Vulnerable to Oracle Padding Attack
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_encrypt_binstar_token implementation in the conda-smithy package has been identified…
-
Low 2.7
conda-smithy Has Incorrect Default File Permissions
conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.47.1, the travis_headers function in the conda-smithy repository creates files with permissions excee…
-
Medium 6.7
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege …
-
High 7.7
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to …
-
Critical 9.8
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentic…
-
Critical 9.8
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to a…
-
High 8.8
A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to …
-
High 8.8
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authenti…
-
Critical 9.8CVE-2025-49213 EPSS 13%
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentic…
-
Critical 9.8CVE-2025-49212 EPSS 13%
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentic…
-
High 7.8
Fuji Electric Smart Editor Stack-based Buffer Overflow
Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.
-
High 7.8
Fuji Electric Smart Editor Out-of-bounds Write
Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code.
-
High 7.8
Fuji Electric Smart Editor Out-of-bounds Read
Fuji Electric Smart Editor is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.
-
High 7.7
A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate p…
-
Medium 5.5
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial…
-
High 7.8
A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allo…
-
High 7.8
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privil…
-
High 8.8
llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: l…
-
High 7.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipu…
-
Medium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could all…
-
Medium 6.5
A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could all…
-
Medium 5.5
Core Privileged Access Manager (BoKS) Leakage of Sensitive Data via the Cache
A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1 (up to 8.1.1.7), 9.0.0 (up to 9.0.0.1) and also legacy tar installs of BoKS 7.2 without hotfix #047…
-
High 8.8
Sitecore PowerShell Extension RCE via Unrestricted Upload
Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. A remote, authenticated attacker can upload arbitrary files to the server using…
-
High 8.8
Sitecore XM, XC, and XP Post-Auth RCE via Zip Slip
Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. A remote, authenticated attacker can exploit this issue by sending a crafted HTTP…
-
Medium 6.8
An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could …
-
Medium 6.7
An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to es…
-
High 7.8
A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escala…
-
High 7.0
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privi…
-
High 8.8
An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attack…
-
High 8.7
An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could all…
-
High 8.4
Out-of-bounds Read in Write in LS Electric GMWin 4
A Heap-based Buffer Overflow vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and w…
-
High 8.4
Out-of-bounds Read in Write in LS Electric GMWin 4
An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing …
-
High 7.8
Out-of-bounds Write in LS Electric GMWin 4
An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which can result in different memory corruption issues within the application, such as reading and writing…
-
High 7.5
Sitecore XM and XP Hardcoded Credentials
Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, and 10.4 to 10.4.1 rev. 011941 PRE contain a hardcoded user account. Unauthenticated and remote attack…
-
Critical 9.8
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentica…