Thu, Jul 23 · 10:16 PM CDTCVE-2025-71389
10.0/10 · Must read/watchNVDvuln
Summary
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be
CVECVE-2025-71389
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 23 · 10:16 PM CDT
ModifiedTue, Sep 29 · 02:10 PM CDT
CVE-2026-13019
9.8/10 · Must read/watchNVDvuln
Summary
Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be affected: Portal for ArcGIS 12.1 and earlier. Other unsupport
CVECVE-2026-13019
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 07 · 05:16 PM CDT
ModifiedTue, Sep 29 · 08:17 PM CDT
CVE-2026-24061
9.8/10 · Must read/watchNVDvuln
Summary
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVECVE-2026-24061
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jan 21 · 07:16 AM CST
ModifiedTue, Sep 29 · 08:17 PM CDT
CVE-2025-11919
9.6/10 · Must read/watchNVDvuln
Summary
The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shar
CVECVE-2025-11919
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jun 26 · 04:16 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2026-54812
9.3/10 · Must read/watchNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Blind SQL Injection.This issue affects Motors: from n/a through 1.4.109.
CVECVE-2026-54812
SeverityCRITICAL
TypeUPDATED
PublishedWed, Jun 17 · 03:17 PM CDT
ModifiedWed, Sep 30 · 06:17 AM CDT
CVE-2025-55017
9.1/10 · Must read/watchNVDvuln
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue.
CVECVE-2025-55017
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jun 26 · 01:16 PM CDT
ModifiedTue, Sep 29 · 08:10 PM CDT
CVE-2025-64152
9.1/10 · Must read/watchNVDvuln
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 before 1.3.6, from 2.0.0 before 2.0.7. Users are recommended to upgrade to version 1.3.6 and 2.0.7, which fixes the issue.
CVECVE-2025-64152
SeverityCRITICAL
TypeUPDATED
PublishedFri, Jun 26 · 01:16 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-30007
8.8/10 · Worth your timeNVDvuln
Summary
HestiaCP before 1.9.5 contains an authenticated OS command injection vulnerability that allows low-privilege authenticated users to execute arbitrary commands as root by injecting a single-quote character into unvalidated DNS record types. Attackers can exploit insufficient input validation in is_dns_record_format_vali
CVECVE-2025-30007
SeverityHIGH
TypeUPDATED
PublishedFri, Jul 10 · 07:17 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-6784
8.8/10 · Worth your timeNVDvuln
Summary
The Code Engine plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.3.5 via the 'code-engine' shortcode. This is due to the plugin not restricting access to the code injecting functionality of the plugin. This makes it possible for authenticated attackers, with Contributo
CVECVE-2025-6784
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 11 · 07:16 AM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-68052
8.8/10 · Worth your timeNVDvuln
Summary
Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.
CVECVE-2025-68052
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 26 · 03:16 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-71390
8.8/10 · Worth your timeNVDvuln
Summary
SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions. An authenticated user can invoke http:: ( ) with a hostname that resolves to a denied IP address, causing the server to issue the req
CVECVE-2025-71390
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 18 · 02:17 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2026-57759
8.8/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Cross Site Request Forgery.This issue affects ProfileGrid: from n/a through 6.0.0.2.
CVECVE-2026-57759
SeverityHIGH
TypeUPDATED
PublishedThu, Jul 02 · 12:17 PM CDT
ModifiedWed, Sep 30 · 08:16 AM CDT
CVE-2025-15662
8.6/10 · Worth your timeNVDvuln
Summary
The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing data
CVECVE-2025-15662
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 27 · 07:16 AM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-7737
8.6/10 · Worth your timeNVDvuln
Summary
DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: before DKCMAIN Ver.93-07-21-80/00-05, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-07-01-80/00-07, CHB(iSCSI) Ver.88-01-02-04, before DKCMAIN Ver.93-06-82-80/00-06,
CVECVE-2025-7737
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 19 · 06:16 AM CDT
ModifiedTue, Sep 29 · 08:10 PM CDT
CVE-2026-17107
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unre
CVECVE-2026-17107
SeverityHIGH
TypeUPDATED
PublishedFri, Jul 24 · 07:16 PM CDT
ModifiedTue, Sep 29 · 07:17 PM CDT
CVE-2025-53831
8.2/10 · Worth your timeNVDvuln
Summary
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization
CVECVE-2025-53831
SeverityHIGH
TypeUPDATED
PublishedMon, Jul 06 · 05:16 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2022-25863
8.1/10 · Worth your timeNVDvuln
Summary
The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both
CVECVE-2022-25863
SeverityHIGH
TypeUPDATED
PublishedFri, Jun 10 · 08:15 PM CDT
ModifiedTue, Sep 29 · 03:50 PM CDT
CVE-2023-22491
8.1/10 · Worth your timeNVDvuln
Summary
Gatsby is a free and open source framework based on React that helps developers build websites and apps. The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input i
CVECVE-2023-22491
SeverityHIGH
TypeUPDATED
PublishedFri, Jan 13 · 07:15 PM CST
ModifiedTue, Sep 29 · 03:06 PM CDT
CVE-2024-44986
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to make sure the dst and associated idev are alive.
CVECVE-2024-44986
SeverityHIGH
TypeUPDATED
PublishedWed, Sep 04 · 08:15 PM CDT
ModifiedTue, Sep 29 · 01:17 PM CDT
CVE-2025-71392
8.0/10 · Worth your timeNVDvuln
Summary
SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious names containing SurrealQL. When a higher-privileged user subsequently
CVECVE-2025-71392
SeverityHIGH
TypeUPDATED
PublishedSat, Jul 18 · 02:17 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-24815
7.8/10 · Worth your timeNVDvuln
Summary
Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an authenticated attacker to upload malicious files onto the system.
CVECVE-2025-24815
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 30 · 10:16 AM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-71408
7.8/10 · Worth your timeNVDvuln
Summary
NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly
CVECVE-2025-71408
SeverityHIGH
TypeUPDATED
PublishedFri, Jul 24 · 10:16 PM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2025-7406
7.8/10 · Worth your timeNVDvuln
Summary
Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can escalate to full root privileges on the host. Successful exploitation results in root-level access to the filesystem and the ability to execute actions as root. The
CVECVE-2025-7406
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 30 · 10:16 AM CDT
ModifiedTue, Sep 29 · 07:10 PM CDT
CVE-2026-0019
7.8/10 · Worth your timeNVDvuln
Summary
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVECVE-2026-0019
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 17 · 01:19 PM CDT
ModifiedTue, Sep 29 · 12:17 PM CDT
CVE-2026-0017
7.7/10 · Worth your timeNVDvuln
Summary
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVECVE-2026-0017
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 02 · 07:16 PM CST
ModifiedTue, Sep 29 · 12:17 PM CDT
