Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 785 | 0,2 % |
| ≥50 % | 3.557 | 0,9 % |
| ≥10 % | 13.139 | 3,2 % |
| <10 % | 391.117 | 95,7 % |
CVE-2025-61224 | DokuWiki 2025-05-14a q cross site scripting (Issue 4512)
A vulnerability classified as problematic was found in DokuWiki 2025-05-14a. This impacts an unknown function. Executing a manipulation of the argument q can lead to cross site scripting. This vulnerability is tracked as CVE-2025-61224. The
CVE-2025-61198 | Orban Optimod 5750HD Web UI cross site scripting
A vulnerability marked as problematic has been reported in Orban Optimod 5750HD, Optimod 5950, Optimod 5950HD and Optimod Trio. This vulnerability affects unknown code of the component Web UI. The manipulation leads to cross site scripting.
CVE-2025-61197 | Orban Optimod 5750 client-side enforcement of server-side security
A vulnerability described as critical has been identified in Orban Optimod 5750, Optimod 5750HD, Optimod 5950, Optimod 5950HD and Trio. This issue affects some unknown processing. The manipulation results in client-side enforcement of serve
CVE-2025-60962 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability, which was classified as critical, was found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. Affected by this vulnerability is an unknown functionality. The manipulation results in os command injection. This
CVE-2025-60961 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross site scripting
A vulnerability identified as problematic has been detected in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. The impacted element is an unknown function. This manipulation causes cross site scripting. This vulnerability is h
CVE-2025-60960 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability has been found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 and classified as critical. Affected by this issue is some unknown functionality. This manipulation causes os command injection. This vulnerabili
CVE-2025-60959 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability categorized as critical has been discovered in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. The affected element is an unknown function. The manipulation results in os command injection. This vulnerability i
CVE-2025-60958 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross site scripting
A vulnerability marked as problematic has been reported in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. This impacts an unknown function. Performing a manipulation results in cross site scripting. This vulnerability was nam
CVE-2025-60957 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 os command injection
A vulnerability, which was classified as critical, has been found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. Affected is an unknown function. The manipulation leads to os command injection. This vulnerability is listed
CVE-2025-60956 | EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00 cross-site request forgery
A vulnerability was found in EndRun Sonoma D12 Network Time Server 6010-0071-000 Ver 4.00. It has been rated as problematic. Impacted is an unknown function. The manipulation leads to cross-site request forgery. This vulnerability is traded
CVE-2025-57247 | BATBToken Smart Contract Compiler 0.8.26 setColdWhiteList/setSpecialAddress access control
A vulnerability was found in BATBToken Smart Contract Compiler 0.8.26. It has been rated as critical. This affects the function setColdWhiteList/setSpecialAddress. Performing a manipulation results in improper access controls. This vulnerab
CVE-2024-6237 | 389-ds-base Extended Search Request denial of service (EUVD-2024-47979 / Nessus ID 210486)
A vulnerability marked as problematic has been reported in 389-ds-base. Affected by this vulnerability is an unknown functionality of the component Extended Search Request Handler. The manipulation leads to denial of service. This vulnerabi
CVE-2023-33952 | Linux Kernel vmwgfx Driver vmwgfx_bo.c double free (EUVD-2023-38088 / Nessus ID 214457)
A vulnerability has been found in Linux Kernel and classified as critical. The affected element is an unknown function of the file drivers/gpu/drm/vmwgfx/vmwgfx_bo.c of the component vmwgfx Driver. The manipulation leads to double free. Thi
SSH-Sicherheitslücke in Alpine Linux: Login ohne Passwort möglich - All About Security
Sinnvoll ist es, zuerst die aus dem Internet erreichbaren Hosts zu prüfen: Welche Server bieten SSH an, welche akzeptieren Passwörter, und welche sind ... Weiterlesen
Patch verification for CVE-2025-4517 in containers and dependencies
Patch verification for CVE-2025-4517 in containers and dependencies Why checking one interpreter is not enough CVE-2025-4517 is a critical arbitrary-file-write flaw in Python tar extraction. It can bypass the intended path boundary even whe
CVE-2025-60454 | MetInfo CMS 8.0 Image Management img_admin.class.php cross site scripting
A vulnerability was found in MetInfo CMS 8.0 and classified as problematic. The affected element is an unknown function of the file app\system\img\admin\img_admin.class.php of the component Image Management Module. The manipulation results
CVE-2025-60453 | MetInfo CMS 8.0 Column Management index.class.php cross site scripting
A vulnerability has been found in MetInfo CMS 8.0 and classified as problematic. Impacted is an unknown function of the file app\system\column\admin\index.class.php of the component Column Management Module. The manipulation leads to cross
CVE-2025-60452 | MetInfo CMS 8.0 Download Management download_admin.class.php cross site scripting
A vulnerability, which was classified as problematic, was found in MetInfo CMS 8.0. This issue affects some unknown processing of the file app\system\download\admin\download_admin.class.php of the component Download Management Module. Execu
CVE-2025-60451 | MetInfo CMS 8.0 Website Settings uploadify.class.php cross site scripting
A vulnerability, which was classified as problematic, has been found in MetInfo CMS 8.0. This vulnerability affects unknown code of the file app\system\include\module\uploadify.class.php of the component Website Settings Module. Performing
CVE-2025-60450 | MetInfo CMS 8.0 SVG File Uploader.class.php cross site scripting
A vulnerability classified as problematic was found in MetInfo CMS 8.0. This affects an unknown part of the file app\system\include\module\editor\Uploader.class.php of the component SVG File Handler. Such manipulation leads to cross site sc
CVE-2025-60449 | SeaCMS 13.1 admin_safe.php information disclosure
A vulnerability was found in SeaCMS 13.1. It has been classified as problematic. The impacted element is an unknown function of the file admin_safe.php. This manipulation causes information disclosure. This vulnerability is registered as CV
CVE-2025-39947 | Linux Kernel up to 6.6.107/6.12.48/6.16.8 mlx5_uplink_netdev_get null pointer dereference (Nessus ID 269450 / WID-SEC-2025-2194)
A vulnerability identified as critical has been detected in Linux Kernel up to 6.6.107/6.12.48/6.16.8. Impacted is the function mlx5_uplink_netdev_get. The manipulation leads to null pointer dereference. This vulnerability is referenced as
IT Security News Hourly Summary 2026-11-06 21h : 15 posts
15 posts published in the last hour 19:32GhostMap Android Vulnerability Can Crash Phones Without Opening an App 19:32CISA Adds One Known Exploited Vulnerability to Catalog 19:32Certificate authority DigiCert reports data breach involving bu
CVE-2026-102530 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript in the Welcome renderer and abuse its privileged IPC bridge to execute arbitrary code with the user’s privileges. The Welcome view also unsafely renders RSS news-feed titles; exploi
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to sub
CVE-2025-8277 | Red Hat Enterprise Linux/OpenShift Container Platform libssh memory leak (EUVD-2025-27246 / Nessus ID 264494)
A vulnerability, which was classified as problematic, was found in Red Hat Enterprise Linux and OpenShift Container Platform. Affected by this issue is some unknown functionality of the component libssh. Such manipulation leads to memory le
CVE-2025-60448 | Emlog Pro 2.5.19 SVG File /admin/media.php cross site scripting
A vulnerability was found in Emlog Pro 2.5.19. It has been rated as problematic. This impacts an unknown function of the file /admin/media.php of the component SVG File Handler. Performing a manipulation results in cross site scripting. Thi
CVE-2025-60447 | Emlog Pro 2.5.19 Email Template Configuration setting.php?action=mail cross site scripting
A vulnerability was found in Emlog Pro 2.5.19. It has been declared as problematic. This affects an unknown function of the file /admin/setting.php?action=mail of the component Email Template Configuration. Such manipulation leads to cross
CVE-2025-60445 | XunRuiCMS 4.7.1 SVG File Upload.php cross site scripting
A vulnerability classified as problematic has been found in XunRuiCMS 4.7.1. Affected by this issue is some unknown functionality in the library dayrui/Fcms/Library/Upload.php of the component SVG File Handler. This manipulation causes cros
CVE-2025-60019 | Red Hat Enterprise Linux up to 10 glib-networking null pointer dereference (ID 227 / Nessus ID 266124)
A vulnerability described as problematic has been identified in Red Hat Enterprise Linux 6/7/8/9/10. This issue affects some unknown processing of the component glib-networking. The manipulation results in null pointer dereference. This vul
CVE-2025-60018 | Red Hat Enterprise Linux up to 10 glib-networking BIO_write out-of-bounds (ID 226 / Nessus ID 266140)
A vulnerability classified as critical was found in Red Hat Enterprise Linux 6/7/8/9/10. The affected element is the function BIO_write of the component glib-networking. Such manipulation leads to out-of-bounds read. This vulnerability is u
CVE-2025-56019 | Agasta Easytouch+ 9.3.97 Bluetooth Low Energy denial of service
A vulnerability labeled as problematic has been found in Agasta Easytouch+ 9.3.97. Affected is an unknown function of the component Bluetooth Low Energy Handler. Such manipulation leads to denial of service. This vulnerability is listed as
CVE-2025-55002 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in the application process. An attacker who can already execute code as the current user can therefore run code in JupyterLab Desktop's context and inherit TCC permissions previously granted to the application, including access
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS shipped with Electron's RunAsNode fuse enabled, allowing ELECTRON_RUN_AS_NODE to execute arbitrary Node.js code in t
CVE-2026-86044 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab before 4.4.8, an attacker can place a crafted MathJax link in an untrusted notebook. If a victim opens the notebook and clicks the link, the existing renderer navigates to an attacker
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a
CVE-2025-54991 | JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to honor DYLD_INSERT_LIBRARIES despite the hardened runtime. An attacker who can already execute code as the current user can load an arbitrary dynamic library into the JupyterLab Desktop process and inherit TCC permissions previo
JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop for macOS declared the com.apple.security.cs.allow-dyld-environment-variables entitlement, allowing the dynamic linker to hono
CVE-2026-85737 | Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks before the mysql and postgres branches pass a caller-controlled connstring to sql.Open, allowing arbitrary outbound database connections. With attacker-controlled MySQL connection options that enable local-infile access, a ro
Velociraptor is a tool for collecting host-based state information using Velociraptor Query Language (VQL) queries. Prior to 0.77.2, SQLPlugin.Call in vql/parsers/sql/sql.go does not enforce plugin-level FILESYSTEM_READ or NETWORK checks be
CVE-2026-63439 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header selected by the AUTH_PROXY_HEADER_FOR_USER configuration setting, without confirming that the request originated from a configured trusted proxy. A remote client that can reach the a
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER iden
CVE-2026-63438 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retrieveById() creates an account for an unknown REMOTE_USER, promotes the first created account to administrator, and synchronizes the account email from the configured mail header. An u
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a
CVE-2026-63440 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::storeRemoteImage() resolve the same hostname again for the HTTP request. When external otpauth image fetching is enabled, an authenticated user controlling low-TTL authoritative DNS can return a public address during validat
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the otpauth image-fetch path validates a hostname through ValidatesUrls::isExternalHost() and then lets IconService::s
CVE-2026-63441 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 prefixes, so an otpauth URI image parameter can pass an IPv6 literal or DNS64-synthesized address whose embedded IPv4 target is private, link-local, loopback, or cloud metadata. In a deployment with image fetching enabled an
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. From 6.1.0 until 8.0.0, App\Services\Traits\ValidatesUrls::isPublicIp() does not recognize the 64:ff9b::/96 and 64:ff9b:1::/48 NAT64 p
CVE-2026-63437 | 2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel model binding but does not call the manageShares authorization policy before listing its recipients. When account sharing is enabled, an authenticated user can call GET /api/v1/twofaccounts/{victimId}/reci
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccoun
CVE-2026-59171 | JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or BigDecimal conversion without a length limit. An application that parses attacker-controlled JSON or XML through JSONObject, JSONArray, or XML.toJSONObject can spend super-linear CPU time converting a sufficiently long numeric
JSON-java is a reference implementation of a JSON package in Java. From version 20150729 through 20260522, JSONTokener.nextSimpleValue can accumulate unbounded numeric tokens before JSONObject.stringToNumber passes them to BigInteger or Big
CVE-2026-103682 | Checkmk up to 2.5.0p15 Jolokia Special Agent information disclosure (WID-SEC-2026-4035)
A vulnerability, which was classified as problematic, was found in Checkmk up to 2.5.0p15. The impacted element is an unknown function of the component Jolokia Special Agent. The manipulation results in information disclosure. This vulnerab
CVE-2026-101333 | Red Hat Keycloak/Single Sign-On Micrometer user-event metrics listener memory allocation (WID-SEC-2026-3614)
A vulnerability, which was classified as critical, has been found in Red Hat Keycloak and Single Sign-On. This affects an unknown part of the component Micrometer user-event metrics listener. The manipulation leads to uncontrolled memory al
CVE-2026-123277 | JetBrains CLion up to 2026.2.4.0/2026.3.0.0 missing authentication (WID-SEC-2026-4381)
A vulnerability marked as problematic has been reported in JetBrains CLion up to 2026.2.4.0/2026.3.0.0. The affected element is an unknown function. The manipulation leads to missing authentication. This vulnerability is referenced as CVE-2
CVE-2026-103674 | Checkmk up to 2.5.0p15 Special Agent information disclosure (WID-SEC-2026-4035)
A vulnerability, which was classified as problematic, has been found in Checkmk up to 2.5.0p15. The affected element is an unknown function of the component Special Agent. The manipulation leads to information disclosure. This vulnerability
CVE-2026-123276 | JetBrains CLion prior 2026.3/2026.2.4.1 GDB Server Debug Profile code injection (WID-SEC-2026-4381)
A vulnerability classified as problematic has been found in JetBrains CLion. Affected is an unknown function of the component GDB Server Debug Profile. This manipulation causes code injection. This vulnerability is registered as CVE-2026-12
CVE-2026-65960 | Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node hostNetwork pods can reach the listener and invoke privileged methods without authentication. These methods can add, delete, or reconfigure tracing policies and change debug settings
Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An atta
CVE-2026-58115 | Siemens SIMATIC IoT2050 Advanced up to 1.28 Node-RED HTTP interface improper authentication (WID-SEC-2026-4382)
A vulnerability, which was classified as very critical, has been found in Siemens SIMATIC IoT2050 Advanced. The impacted element is an unknown function of the component Node-RED HTTP interface. The manipulation leads to improper authenticat
CVE-2026-123655 | Moodle up to 4.5.14/5.0.10/5.1.7/5.2.3 H5P access control (WID-SEC-2026-4385)
A vulnerability was found in Moodle up to 4.5.14/5.0.10/5.1.7/5.2.3. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the component H5P. This manipulation causes improper access controls. This
CVE-2026-58490 | Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaults and disabling both signature requirements. An unauthenticated attacker who can reach the SAML assertion consumer endpoint can submit a forged unsigned response for an existing Trac
Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty valu
CVE-2026-63663 | CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the int
CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open fi
CVE-2026-63664 | CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a shared database connection can initiate certain server-side data exports even when an administrator has disabled exports. This can disclose database contents that the user is permitted to query but is not permitted to export.
CloudBeaver is a cloud database manager. In versions up to and including 26.1.1, some server-side export operations do not consistently enforce the global data export restriction. An authenticated non-administrative user with access to a sh
CVE-2026-55449 | CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary
CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privilege
CVE-2026-73860 | CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the target process can keep an rseq critical section armed over that injection point so the kernel's restartable-sequence abort redirects execution to an attacker-controlled callback when CRIU resumes the process. In container sn
CRIU is a checkpoint and restore tool for Linux. Prior to 4.2.1, CRIU injects a syscall;int3 sequence at the start of the first executable virtual memory area and resumes the target process to execute parasite code. Malicious code in the ta
CVE-2026-55649 | GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist arbitrary HTML and JavaScript that executes in another user's browser when the document page is visited. This issue is fixed in version 5.0.3.
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, document abstract metadata is stored without sanitization, allowing a low-privileged remote user to persist
CVE-2026-46429 | GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remote user to store and serve malicious files. This issue is fixed in version 5.0.3.
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.0.3, specially crafted requests can circumvent GeoNode upload service validation, allowing a low-privileged remo
CVE-2026-33050 | GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell syntax and execute arbitrary operating-system commands on the GeoNode server. This issue is fixed in version 5.1.0.
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. Prior to 5.1.0, a crafted vector file layer name supplied during upload allows a low-privileged remote user to inject shell
CVE-2025-59407 | Flock Safety Bravo Edge AI Compute Device 6.35.33 on Android com.flocksafety.android.objects flock_rye.bks hard-coded password
A vulnerability described as critical has been identified in Flock Safety Bravo Edge AI Compute Device 6.35.33 on Android. Affected by this issue is some unknown functionality of the file flock_rye.bks of the component com.flocksafety.andro
CVE-2024-4603 | OpenSSL up to 3.0.13/3.1.5/3.2.1/3.3.0 DSA crypto/dsa/dsa_check.c EVP_PKEY_param_check/EVP_PKEY_public_check denial of service (Nessus ID 209278 / WID-SEC-2024-1171)
A vulnerability categorized as problematic has been discovered in OpenSSL up to 3.0.13/3.1.5/3.2.1/3.3.0. This impacts the function EVP_PKEY_param_check/EVP_PKEY_public_check of the file crypto/dsa/dsa_check.c of the component DSA Handler.
CVE-2024-2511 | OpenSSL up to 1.1.1x/3.0.13/3.1.5/3.2.1 TLSv1.3 denial of service (Nessus ID 209278)
A vulnerability was found in OpenSSL up to 1.1.1x/3.0.13/3.1.5/3.2.1. It has been classified as critical. The impacted element is an unknown function of the component TLSv1.3 Handler. Performing a manipulation results in denial of service.