Archive
6 August 2025
Vulnerabilities first published on this day (UTC), newest first.
136 results · Clear filters · Feed
-
Medium 5.3
SuiteCRM: Legacy iCal service allows unauthenticated access to meeting data
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authentication in the legacy iCal service allows unauthenticated access to meeting data. An unauthenticated acto…
-
Medium 5.3
PSD File Parsing Out-of-Bounds Read Vulnerability
A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of …
-
Medium 6.3
SkyworkAI DeepResearchAgent tools.py from_mcp os command injection
A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the function from_code/from_dict/from_mcp of the file src/tools/tools.py. The manipulation leads to os comm…
-
Medium 5.3
Org.keycloak/keycloak-services: keycloak smtp inject vulnerability
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack …
-
Medium 6.3
agno-agi agno Model Context Protocol mcp.py MultiMCPTools os command injection
A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the library libs/agno/agno/tools/mcp.py of the component Model Context Protocol Handler. The manipulation…
-
Medium 5.4
Cisco Webex Meeting Client Join Certificate Validation Vulnerability
A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeting-join process in place of an intended targeted user, provided the requisite conditions were satisf…
-
Medium 4.3
Cisco Identity Services Engine Authorization Bypass Vulnerability
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permi…
-
Medium 5.4
Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy
A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-sup…
-
Medium 4.7
An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…
-
Medium 5.7
The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentia…
-
Medium 5.0
Path Traversal
The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the…
-
Medium 6.5
Lack of TLS validation
Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs
-
Medium 5.9
IBM Guardium Data Protection information disclosure
IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information.
-
Medium 6.1
Malicious browser plugins may cause Authentication replay attack vulnerability to bypass authentication in OpenText Advanced Authentication
A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Authentication. This issue affects Advanced Authentication on or before 6.5.0.
-
Medium 4.4
NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacke…
-
Medium 5.9
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Medium 5.9
NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker …
-
Medium 5.3
Regular Expression Denial of Service (ReDoS) in huggingface/transformers
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt_weight_name()` function. This function, responsible for converting TensorFlow weight names to PyTor…
-
Medium 6.5
-
Medium 6.5
-
Medium 4.3
-
Medium 6.5
Vault LDAP MFA Enforcement Bypass When Using Username As Alias
Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs that are equal but with leading or trailing spaces. Fixed in Vault Community Edition 1.20.2 and Vault …
-
Medium 5.3
GiveWP – Donation Plugin and Fundraising Platform <= 4.6.0 - Unauthenticated Donor Data Exposure
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. This makes it possible for unauthenticated attackers to extract donor names, emails, and donor id. CV…
-
Medium 5.1
Cross-Site Request Forgery (CSRF) allowed remote control of Elgato Key Lights
A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights.
-
Medium 5.5
Buffer Copy Without Checking Size of Input in Automotive Vehicle Networks
Information disclosure while processing a packet at EAVB BE side with invalid header length.
-
Medium 5.5
Leftover Debug Code in Secure Element
Information disclosure while capturing logs as eSE debug messages are logged.
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.
-
Medium 6.5
Out-of-bounds Read in Core
Information disclosure while reading data from an image using specified offset and size parameters.
-
Medium 6.1
Buffer Over-read in Automotive OS Platform Android
Information disclosure while opening a fastrpc session when domain is not sanitized.
-
Medium 6.0
Race Condition in Shopware Voucher Submission
A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrictions and exceed usage limitations.
-
Medium 6.4
Gutenverse <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text and Fun Fact Blocks
The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping on user supplied attribu…
-
Medium 5.9
Information Tampering Vulnerability in Multiple Processes of GENESIS64, ICONICS Suite, MobileHMI, Hyper Historian, AnalytiX, IoTWorX, MC Works64, and GENESIS
Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric MobileHMI versions 10.97.3 and prior, Mitsubis…
-
Medium 5.7
Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attacker…
-
Medium 5.7
Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged …
-
Medium 5.5
Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung H…
-
Medium 4.4
Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bo…
-
Medium 6.3
Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged at…
-
Medium 4.3
Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 all…
-
Medium 4.0
Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document …
-
Medium 4.3
Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attacker…