Latest CVE Feed
-
5.0
MEDIUMCVE-2025-62781
PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.8.0, users with a local account can change their password while logged in. When doing so, all other active sessions are terminated, except for the currently ... Read more
Affected Products : pilos- Published: Oct. 27, 2025
- Modified: Nov. 04, 2025
- Vuln Type: Authentication
-
5.0
MEDIUMCVE-2025-23332
NVIDIA Display Driver for Linux contains a vulnerability in a kernel module, where an attacker might be able to trigger a null pointer deference. A successful exploit of this vulnerability might lead to denial of service.... Read more
- Published: Oct. 23, 2025
- Modified: Oct. 27, 2025
- Vuln Type: Denial of Service
-
5.0
MEDIUMCVE-2025-59575
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <=... Read more
Affected Products : masterstudy_lms- Published: Oct. 22, 2025
- Modified: Oct. 23, 2025
- Vuln Type: Information Disclosure
-
5.0
MEDIUMCVE-2025-62763
Zimbra Collaboration (ZCS) before 10.1.12 allows SSRF because of the configuration of the chat proxy.... Read more
Affected Products : collaboration- Published: Oct. 21, 2025
- Modified: Oct. 21, 2025
- Vuln Type: Server-Side Request Forgery
-
5.0
MEDIUMCVE-2025-11128
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzy_sanitize_feeds' function. This m... Read more
Affected Products : rss_aggregator_by_feedzy- Published: Oct. 23, 2025
- Modified: Oct. 27, 2025
- Vuln Type: Server-Side Request Forgery
-
5.0
MEDIUMCVE-2025-11536
The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_elementor_template action. This makes it possible for authenticated attackers,... Read more
Affected Products :- Published: Oct. 20, 2025
- Modified: Oct. 21, 2025
- Vuln Type: Server-Side Request Forgery
-
5.0
MEDIUMCVE-2025-64504
Langfuse is an open source large language model engineering platform. Starting in version 2.70.0 and prior to versions 2.95.11 and 3.124.1, in certain project membership APIs, the server trusted a user‑controlled orgId and used it in authorization checks.... Read more
Affected Products :- Published: Nov. 10, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Authorization
-
5.0
MEDIUMCVE-2025-12103
A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role `trustyai-service-opera... Read more
Affected Products :- Published: Oct. 28, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Authorization
-
5.0
MEDIUMCVE-2025-62453
Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.... Read more
Affected Products : visual_studio_code- Published: Nov. 11, 2025
- Modified: Nov. 12, 2025
-
4.9
MEDIUMCVE-2025-37143
An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated malicious actor to download arbitrary files ... Read more
Affected Products : arubaos- Published: Oct. 14, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Path Traversal
-
4.9
MEDIUMCVE-2025-10683
The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existin... Read more
Affected Products :- Published: Nov. 06, 2025
- Modified: Nov. 06, 2025
- Vuln Type: Injection
-
4.9
MEDIUMCVE-2025-20374
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources. This vulnerability is due to an insufficient input validation associated to specific UI fe... Read more
Affected Products : unified_contact_center_express- Published: Nov. 05, 2025
- Modified: Nov. 06, 2025
- Vuln Type: Path Traversal
-
4.9
MEDIUMCVE-2025-11980
The Quick Featured Images plugin for WordPress is vulnerable to SQL Injection via the 'delete_orphaned' function in all versions up to, and including, 13.7.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on... Read more
Affected Products :- Published: Nov. 08, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Injection
-
4.9
MEDIUMCVE-2025-53409
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from ... Read more
Affected Products : file_station- Published: Nov. 07, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Denial of Service
-
4.9
MEDIUMCVE-2025-11972
The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to SQL Injection via the 'post_types' parameter in all versions up to, and including, 3.40.0 due to insufficient escaping on the user supplied parameter... Read more
Affected Products :- Published: Nov. 08, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Injection
-
4.9
MEDIUMCVE-2025-37145
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through... Read more
Affected Products : arubaos- Published: Oct. 14, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Path Traversal
-
4.9
MEDIUMCVE-2025-37144
Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through... Read more
Affected Products : arubaos- Published: Oct. 14, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Path Traversal
-
4.9
MEDIUMCVE-2025-53410
An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to prevent other systems, applications, or processes from ... Read more
Affected Products : file_station- Published: Nov. 07, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Denial of Service
-
4.9
MEDIUMCVE-2025-37140
Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an authenticated malicious actor to download arbitrary files through carefully cons... Read more
Affected Products : arubaos- Published: Oct. 14, 2025
- Modified: Nov. 12, 2025
- Vuln Type: Path Traversal
-
4.9
MEDIUMCVE-2025-43504
A buffer overflow was addressed with improved bounds checking. This issue is fixed in Xcode 26.1. A user in a privileged network position may be able to cause a denial-of-service.... Read more
Affected Products : xcode- Published: Nov. 04, 2025
- Modified: Nov. 04, 2025
- Vuln Type: Memory Corruption