Archive
23 June 2025
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Medium 4.3
SIFUSM/MZZYG BD S1 RTSP Live Video Stream Endpoint access control
A vulnerability was found in SIFUSM/MZZYG BD S1 up to 20250611. It has been declared as problematic. This vulnerability affects unknown code of the component RTSP Live Video Stream Endpoint. The manipulation leads to improper access controls. Access to the lo…
-
Medium 4.8
70mai M300 Telnet Service demo.sh denial of service
A vulnerability was found in 70mai M300 up to 20250611. It has been classified as problematic. This affects an unknown part of the file demo.sh of the component Telnet Service. The manipulation leads to denial of service. Access to the local network is requir…
-
Medium 4.3
70mai M300 RTSP Live Video Stream Endpoint 12 improper authentication
A vulnerability has been found in 70mai M300 up to 20250611 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /livestream/12 of the component RTSP Live Video Stream Endpoint. The manipulation leads to improp…
-
Medium 4.3
70mai 1S Configuration Config.cgi improper authorization
A vulnerability classified as problematic was found in 70mai 1S up to 20250611. This vulnerability affects unknown code of the file /cgi-bin/Config.cgi?action=set of the component Configuration Handler. The manipulation leads to improper authorization. The at…
-
Medium 6.9
HTMLSanitizer.jl Possible XSS
HTMLSanitizer.jl is a Whitelist-based HTML sanitizer. Prior to version 0.2.1, when adding the style tag to the whitelist, content inside the tag is incorrectly unescaped, and closing tags injected as content are interpreted as real HTML, enabling tag injectio…
-
Medium 6.4
Quarkus potential data leak when duplicating a duplicated context
Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. In versions prior to 3.24.1, 3.20.2, and 3.15.6, there is a potential data leak when duplicating a duplicated context. Quarkus extensively uses the Vert.x duplicated c…
-
Medium 6.3
PySpur-Dev pyspur Jinja2 Template single_llm_call.py SingleLLMCallNode special elements used in a template engine
A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend/pyspur/nodes/llm/single_llm_call.py of the component Jinja2 Template Handler. The manipulation of t…
-
Medium 6.3
Dromara MaxKey Meta URL SAML20DetailsController.java add server-side request forgery
A vulnerability was found in Dromara MaxKey up to 4.1.7 and classified as critical. This issue affects the function Add of the file maxkey-webs\maxkey-web-mgt\src\main\java\org\dromara\maxkey\web\apps\contorller\SAML20DetailsController.java of the component M…
-
Medium 5.3
HDF5 H5Fint.c H5F_addr_decode_len heap-based overflow
A vulnerability has been found in HDF5 up to 1.14.6 and classified as critical. This vulnerability affects the function H5F_addr_decode_len of the file /hdf5/src/H5Fint.c. The manipulation leads to heap-based buffer overflow. An attack has to be approached lo…
-
Medium 4.3
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
-
Medium 4.8
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
-
Medium 5.4CVE-2025-52876 EPSS 39%
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
-
Medium 4.8CVE-2025-52877 EPSS 37%
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
-
Medium 5.4
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
-
Medium 6.6CVE-2025-2172 EPSS 12%
Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the in…
-
Medium 5.1
Potential heap-based buffer over-read vulnerability in NotepadNext
Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, …
-
Medium 4.3
Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a speci…
-
Medium 4.3
An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpo…
-
Medium 5.7
In WhiteBeam 0.2.0 through 0.2.1 before 0.2.2, a user with local access to a server can bypass the allow-list functiona…
-
Medium 6.1CVE-2025-48700 Exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vu…
KEV Apr 20, 2026 -
Medium 6.4
Innoshop through 0.4.1 allows Insecure Direct Object Reference (IDOR) at multiple places within the frontend shop. Anyo…
-
Medium 5.8
MLFlow SSRF via gateway_proxy_handler
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.