🚨 CVE-2025-70999
A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.
🎖@cveNotify
A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.
🎖@cveNotify
GitHub
Daisy2ang - Overview
Daisy2ang has one repository available. Follow their code on GitHub.
🚨 CVE-2025-71000
An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
Daisy2ang - Overview
Daisy2ang has one repository available. Follow their code on GitHub.
🚨 CVE-2025-71001
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
🎖@cveNotify
GitHub
Daisy2ang - Overview
Daisy2ang has one repository available. Follow their code on GitHub.
🚨 CVE-2025-69604
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
🎖@cveNotify
An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.
🎖@cveNotify
🚨 CVE-2025-69929
An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format
🎖@cveNotify
An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using the MD5 algorithm over a predictable string format
🎖@cveNotify
Gist
CVE-2025-69929 - Privilege Escalation via Password Hash Disclosure in n3uron
CVE-2025-69929 - Privilege Escalation via Password Hash Disclosure in n3uron - CVE-2025-69929.md
🚨 CVE-2025-69620
A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
🎖@cveNotify
A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
🎖@cveNotify
🚨 CVE-2025-69621
An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
🎖@cveNotify
An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
🎖@cveNotify
🚨 CVE-2025-69618
An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
🎖@cveNotify
An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information.
🎖@cveNotify
coto
coto — Tarot, Astrology, Healing & Joy AI Companion | Live 24/7, Anonymous
coto blends Joy, your free AI companion, with 300+ verified experts for tarot, astrology, energy healing, meditation, counselling and more. Live 24/7, 100% anonymous.
🚨 CVE-2025-70545
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.
🎖@cveNotify
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.
🎖@cveNotify
GitHub
GitHub - jeyabalaji711/CVE-2025-70545
Contribute to jeyabalaji711/CVE-2025-70545 development by creating an account on GitHub.
🚨 CVE-2025-69619
A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
🎖@cveNotify
A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
🎖@cveNotify
🚨 CVE-2025-65480
An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution.
🎖@cveNotify
An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain script conditions are fulfilled, leading to Remote Code Execution.
🎖@cveNotify
GitHub
vulnerability-research/CVE-2025-65480 at main · derekyjj/vulnerability-research
Contribute to derekyjj/vulnerability-research development by creating an account on GitHub.
🚨 CVE-2025-69752
An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profile information by modifying the objectKey HTTP parameter in the My Details page URL.
🎖@cveNotify
An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profile information by modifying the objectKey HTTP parameter in the My Details page URL.
🎖@cveNotify
Ideagen
Quality management system for standards compliance
Ideagen Quality Management uses AI to automate documentation, saving you time and ensuring compliance.
🚨 CVE-2025-65753
An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.
🎖@cveNotify
An issue in the TLS certification mechanism of Guardian Gryphon v01.06.0006.22 allows attackers to execute commands as root.
🎖@cveNotify
GitHub
GitHub - diegovargasj/CVE-2025-65753: CVE-2025-65753 PoC
CVE-2025-65753 PoC. Contribute to diegovargasj/CVE-2025-65753 development by creating an account on GitHub.
🚨 CVE-2025-70397
jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.
🎖@cveNotify
jizhicms 2.5.6 is vulnerable to SQL Injection in Article/deleteAll and Extmolds/deleteAll via the data parameter.
🎖@cveNotify
🚨 CVE-2025-69725
An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.
🎖@cveNotify
An Open Redirect vulnerability in the go-chi/chi >=5.2.2 RedirectSlashes function allows remote attackers to redirect victim users to malicious websites using the legitimate website domain.
🎖@cveNotify
GitHub
Open redirect vulnerability in the RedirectSlashes middleware
### Summary
The `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.
### Details
The `RedirectSlashes...
The `RedirectSlashes` function in middleware/strip.go does not perform correct input validation and can lead to an open redirect vulnerability.
### Details
The `RedirectSlashes...
🚨 CVE-2025-71056
Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.
🎖@cveNotify
Improper session management in GCOM EPON 1GE ONU version C00R371V00B01 allows attackers to execute a session hijacking attack via spoofing the IP address of an authenticated user.
🎖@cveNotify
GitHub
CVE-Disclosures/CVE-2025-71056/README.md at main · theShinigami/CVE-Disclosures
Contribute to theShinigami/CVE-Disclosures development by creating an account on GitHub.
🚨 CVE-2025-67445
TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.
🎖@cveNotify
TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENT_LENGTH environment variable and allocates memory using malloc (CONTENT_LENGTH + 1) without sufficient bounds checking. When lighttpd s request size limit is not enforced, a crafted large POST request can cause memory exhaustion or a segmentation fault, leading to a crash of the management CGI and loss of availability of the web interface.
🎖@cveNotify
GitHub
GitHub - DaRkSpOoOk/CVE-2025-67445: A PoC for CVE-2025-67445
A PoC for CVE-2025-67445 . Contribute to DaRkSpOoOk/CVE-2025-67445 development by creating an account on GitHub.
🚨 CVE-2025-63409
Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.
🎖@cveNotify
Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to modify administrator only settings and extract administrator credentials.
🎖@cveNotify
GitHub
CVE-Disclosures/CVE-2025-63409 at main · theShinigami/CVE-Disclosures
Contribute to theShinigami/CVE-Disclosures development by creating an account on GitHub.
🚨 CVE-2025-70363
Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.
🎖@cveNotify
Incorrect access control in the REST API of Ibexa & Ciril GROUP eZ Platform / Ciril Platform 2.x allows unauthenticated attackers to access sensitive data via enumerating object IDs.
🎖@cveNotify
Ez
EZ.COM is for sale
Domain Capital Domains for Sale
🚨 CVE-2025-56421
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
🎖@cveNotify
SQL Injection vulnerability in LimeSurvey before v.6.15.4+250710 allows a remote attacker to obtain sensitive information from the database.
🎖@cveNotify
GitHub
security-advisories/CVE-2025-56421.md at main · hongancalif/security-advisories
Contribute to hongancalif/security-advisories development by creating an account on GitHub.
🚨 CVE-2025-56422
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
🎖@cveNotify
A deserialization vulnerability in LimeSurvey before v6.15.0+250623 allows a remote attacker to execute arbitrary code on the server.
🎖@cveNotify
GitHub
security-advisories/CVE-2025-56422.md at main · hongancalif/security-advisories
Contribute to hongancalif/security-advisories development by creating an account on GitHub.