🚨 CVE-2025-36398
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename.
🎖@cveNotify
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename.
🎖@cveNotify
Ibm
Security Bulletin: Multiple vulnerabilities have been identified with the DS8900F and DS8A00 Hardware Management Console (HMC)
DS8900F and DS8A00 updates have been released to remediate vulnerabilities in various components like IBM Java Quarterly Update, IBM WebSphere Application Server, IBM Power HMC, Linux Kernel, OpenSSL, libsoup, libssh, OpenSSH, net-snmp, Apache HTTP Server…
🚨 CVE-2025-14602
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-14601
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-62307
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
🎖@cveNotify
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL IntelliOps Event Management (IEM) - Customer Support
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
🚨 CVE-2025-62299
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
🎖@cveNotify
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL IntelliOps Event Management (IEM) - Customer Support
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
🚨 CVE-2025-62300
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
🎖@cveNotify
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL IntelliOps Event Management (IEM) - Customer Support
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
🚨 CVE-2025-62306
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.
🎖@cveNotify
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response.
🎖@cveNotify
Hcl-Software
Security Bulletin: Multiple security vulnerabilities affect HCL IntelliOps Event Management (IEM) - Customer Support
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
🚨 CVE-2025-52182
The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability.
🎖@cveNotify
The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability.
🎖@cveNotify
Gist
CVE-2025-52182
GitHub Gist: instantly share code, notes, and snippets.
🚨 CVE-2025-15671
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
🎖@cveNotify
The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account after the victim logs in through an attacker-crafted request.
🎖@cveNotify
WPScan
Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter
See details on Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter CVE 2025-15671. View the latest Plugin Vulnerabilities on WPScan.
🚨 CVE-2025-63080
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution.
This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B.
🎖@cveNotify
cert.pl
Vulnerabilities in KAON PG5298A/PG5298B routers
CERT Polska has received a report about 2 vulnerabilities (CVE-2025-63080 and CVE-2026-6017) found in KAON PG5298A/PG5298B routers.
🚨 CVE-2025-68833
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
🎖@cveNotify
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources.
🎖@cveNotify
🚨 CVE-2025-68825
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
🎖@cveNotify
HCL Hive is affected by incorrect default permissions which could allow an attacker unauthorized lateral movement, container breakout, and interception of sensitive internal communications.
🎖@cveNotify
🚨 CVE-2025-36939
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.
🎖@cveNotify
Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread network could send specially crafted packets to cause a denial of service. These issues include triggerable assertion failures and a stack-based buffer overflow.
🎖@cveNotify
Google
Nest Security Bulletin—August 2026 - Help
Published August 20, 2026You can find past Nest Security Bulletins in the archive. This Nest Security Bulletin contains details of security vulnerabilities that previously affected
🚨 CVE-2025-36940
Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)
🎖@cveNotify
Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP)
🎖@cveNotify
Google
Nest Security Bulletin—August 2026 - Help
Published August 20, 2026You can find past Nest Security Bulletins in the archive. This Nest Security Bulletin contains details of security vulnerabilities that previously affected
🚨 CVE-2025-26237
D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.
🎖@cveNotify
D-Link DI-7001 MINI_5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.
🎖@cveNotify
GitHub
iot/CVE/dlink/DI_7001_MINI_5G.md/DI_7001_MINI_5G.md at main · REYu6/iot
Contribute to REYu6/iot development by creating an account on GitHub.
🚨 CVE-2025-26238
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.
🎖@cveNotify
In D-Link DI-8100G 17.12.20A1, the flag parameter in msp_info can be exploited to execute arbitrary code.
🎖@cveNotify
GitHub
iot/CVE/dlink/DI_8100G-17.12.20A1.md/DI_8100G-17.12.20A1.md at main · REYu6/iot
Contribute to REYu6/iot development by creating an account on GitHub.
🚨 CVE-2026-94131
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
🎖@cveNotify
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
🎖@cveNotify