CVE-2025-13674 - Access of Uninitialized Pointer in Wireshark
CVE ID : CVE-2025-13674
Published : Nov. 26, 2025, 12:15 p.m. | 2 hours, 51 minutes ago
Description : BPv7 dissector crash in Wireshark 4.6.0 allows denial of service
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-13674
Published : Nov. 26, 2025, 12:15 p.m. | 2 hours, 51 minutes ago
Description : BPv7 dissector crash in Wireshark 4.6.0 allows denial of service
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-9163 - Houzez <= 4.1.6 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
CVE ID : CVE-2025-9163
Published : Nov. 26, 2025, 1:16 p.m. | 1 hour, 51 minutes ago
Description : The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-9163
Published : Nov. 26, 2025, 1:16 p.m. | 1 hour, 51 minutes ago
Description : The Houzez theme for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.1.6 due to insufficient input sanitization and output escaping in the houzez_property_img_upload() and houzez_property_attachment_upload() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-9191 - Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search
CVE ID : CVE-2025-9191
Published : Nov. 26, 2025, 1:16 p.m. | 1 hour, 51 minutes ago
Description : The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-9191
Published : Nov. 26, 2025, 1:16 p.m. | 1 hour, 51 minutes ago
Description : The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.1.6 via deserialization of untrusted input in saved-search-item.php. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-13601 - Glib: integer overflow in in g_escape_uri_string()
CVE ID : CVE-2025-13601
Published : Nov. 26, 2025, 2:44 p.m. | 22 minutes ago
Description : A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-13601
Published : Nov. 26, 2025, 2:44 p.m. | 22 minutes ago
Description : A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-50399 - FAST FAC1200R F400 Buffer Overflow
CVE ID : CVE-2025-50399
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-50399
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-50402 - FAST FAC1200R Buffer Overflow Vulnerability
CVE ID : CVE-2025-50402
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-50402
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : FAST FAC1200R F400_FAC1200R_Q is vulnerable to Buffer Overflow in the function sub_80435780 via the parameter string fac_password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-56396 - Ruoyi Privilege Escalation Vulnerability
CVE ID : CVE-2025-56396
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-56396
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : An issue was discovered in Ruoyi 4.8.1 allowing attackers to gain escalated privileges due to the owning department having higher rights than the active user.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-62354 - Cisco Cursor Command Injection Vulnerability
CVE ID : CVE-2025-62354
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-62354
Published : Nov. 26, 2025, 4:15 p.m. | 2 hours, 51 minutes ago
Description : Improper neutralization of special elements used in an OS command ('command injection') in Cursor allows an unauthorized attacker to execute commands that are outside of those specified in the allowlist, resulting in arbitrary code execution.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-46175 - Ruoyi Incorrect Access Control Vulnerability
CVE ID : CVE-2025-46175
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-46175
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Ruoyi v4.8.0 is vulnerable to Incorrect Access Control. There is a missing checkUserDataScope permission check in the authRole method of SysUserController.java.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-63938 - Tinyproxy Integer Overflow Vulnerability
CVE ID : CVE-2025-63938
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-63938
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65235 - OpenCode Systems USSD Gateway SQL Injection
CVE ID : CVE-2025-65235
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65235
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 was discovered to contain a SQL injection vulnerability via the ID parameter in the getSubUsersByProvider function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65236 - OpenCode Systems USSD Gateway SQL Injection Vulnerability
CVE ID : CVE-2025-65236
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65236
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : OpenCode Systems USSD Gateway OC Release: 5 was discovered to contain a SQL injection vulnerability via the Session ID parameter in the /occontrolpanel/index.php endpoint.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65237 - OpenCode Systems USSD Gateway XSS
CVE ID : CVE-2025-65237
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65237
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : A reflected cross-site scripted (XSS) vulnerability in OpenCode Systems USSD Gateway OC Release: 5 allows attackers to execute arbitrary JavaScript in the context of a user's browser via injecting a crafted payload.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65238 - OpenCode Systems USSD Gateway Privilege Escalation Vulnerability
CVE ID : CVE-2025-65238
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65238
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Incorrect access control in the getSubUsersByProvider function of OpenCode Systems USSD Gateway OC Release: 5 Version 6.13.11 allows attackers with low-level privileges to dump user records and access sensitive information.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65239 - OpenCode Systems USSD Gateway Access Control Vulnerability
CVE ID : CVE-2025-65239
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65239
Published : Nov. 26, 2025, 5:15 p.m. | 1 hour, 51 minutes ago
Description : Incorrect access control in the /aux1/ocussd/trace endpoint of OpenCode Systems USSD Gateway OC Release:5, version 6.13.11 allows attackers with low-level privileges to read server logs.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-65966 - OneUptime Unauthorized User Creation via API
CVE ID : CVE-2025-65966
Published : Nov. 26, 2025, 6:10 p.m. | 57 minutes ago
Description : OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-65966
Published : Nov. 26, 2025, 6:10 p.m. | 57 minutes ago
Description : OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API request instead of being restricted to the intended interface. This issue has been patched in version 9.1.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-66028 - OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation
CVE ID : CVE-2025-66028
Published : Nov. 26, 2025, 6:11 p.m. | 55 minutes ago
Description : OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-66028
Published : Nov. 26, 2025, 6:11 p.m. | 55 minutes ago
Description : OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Response Manipulation. During the login process, the server response included a parameter called isMasterAdmin. By intercepting and modifying this parameter value from false to true, it is possible to gain access to the admin dashboard interface. However, an attacker may be unable to view or interact with the data if they still do not have sufficient permissions. This issue has been patched in version 8.0.5567.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-11461 - Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller
CVE ID : CVE-2025-11461
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-11461
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statements. This issue affects Frappe CRM: 1.53.1.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-13084 - Opto 22 groov View Exposure of Sensitive Information Through Metadata
CVE ID : CVE-2025-13084
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-13084
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role to access and will display API keys for all users, including Administrators.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-20373 - Sensitive Information Disclosure in “_internal“ index through Splunk Add-On for Palo Alto Networks
CVE ID : CVE-2025-20373
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) in the Splunk documentation for more information.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-20373
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new “Data Security Accounts“. The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) in the Splunk documentation for more information.
Severity: 2.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE-2025-2486 - UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu
CVE ID : CVE-2025-2486
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...
CVE ID : CVE-2025-2486
Published : Nov. 26, 2025, 6:15 p.m. | 51 minutes ago
Description : The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...