Explore CVE records

MedPublished 16 Sep 2025, 19:16 WIB

CVE-2025-55110

BMC Control-M/Agent hardcoded default keystore password

Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data using this password.

Excerpt language: en.

CVSS5.7v4.0KEVNot listedEPSSPresentUpdated17 Sep 2025, 01:29 WIB

Official record

CritPublished 16 Sep 2025, 19:14 WIB

CVE-2025-55109

BMC Control-M/Agent default SSL/TLS configuration authenticated bypass

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore or a default PKCS#12 keystore. A remote attacker with access to a signed third-party or demo certificate for client authe…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CritPublished 16 Sep 2025, 18:52 WIB

CVE-2025-7743

Sensitive Data Exposure in Dolusoft's Omaspot

Cleartext Transmission of Sensitive Information vulnerability in Dolusoft Omaspot allows Interception, Privilege Escalation. This issue affects Omaspot: before 12.09.2025.

Excerpt language: en.

CVSS9.6v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 20:37 WIB

Official record

CritPublished 16 Sep 2025, 18:50 WIB

CVE-2025-7744

SQLi in Dolusoft's Omaspot

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dolusoft Omaspot allows SQL Injection. This issue affects Omaspot: before 12.09.2025.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 18:48 WIB

Official record

MedPublished 16 Sep 2025, 18:48 WIB

CVE-2025-6575

XSS in Dolusoft's Omaspot

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 21:02 WIB

Official record

HighPublished 16 Sep 2025, 18:39 WIB

CVE-2024-12913

SQLi in Megatek Communication System's Azora Wireless Network Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Megatek Communication System Azora Wireless Network Management allows SQL Injection. This issue affects Azora Wireless Network Management: through 20250916. NOTE: The vendor did not inform about the completion of th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated01 Jun 2026, 19:58 WIB

Official record

MedPublished 16 Sep 2025, 18:17 WIB

CVE-2025-8446

Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install

The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized limited plugin install due to a missing capability check on the 'blaze_demo_importer_install_plugin' function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and abov…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:14 WIB

Official record

HighPublished 16 Sep 2025, 17:15 WIB

CVE-2025-41249

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions. Your application may be affected by this if you are using …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:29 WIB

Official record

HighPublished 16 Sep 2025, 17:10 WIB

CVE-2025-41248

CVE-2025-41248: Spring Security authorization bypass for method security annotations on parameterized types

The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue when using @PreAuthorize and other method security annotations, resulting in an authorization bypass. Your applicatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated18 Sep 2025, 13:29 WIB

Official record

HighPublished 16 Sep 2025, 17:03 WIB

CVE-2025-10016

Local Privilege Escalation in Sparkle Autoupdate Daemon

The Sparkle framework includes a helper tool Autoupdate. Due to lack of authentication of connecting clients a local unprivileged attacker can request installation of crafted malicious PKG file by racing to connect to the daemon when other app spawns it as root. This results in local privilege escalation to root privi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:27 WIB

Official record

MedPublished 16 Sep 2025, 17:03 WIB

CVE-2025-10015

TCC Bypass via Downloader XPC Service in Sparkle

The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:26 WIB

Official record

MedPublished 16 Sep 2025, 16:35 WIB

CVE-2025-26711

There is an unauthorized access vulnerability in ZTE T5400. Due to improper permission control of the Web module interface, an unauthorized attacker can obtain sensitive information through the interface.

Excerpt language: en.

CVSS5.7v3.1KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:26 WIB

Official record

LowPublished 16 Sep 2025, 16:14 WIB

CVE-2025-26710

There is an an information disclosure vulnerability in ZTE T5400. Due to improper configuration of the access control mechanism, attackers can obtain information through interfaces without authorization, causing the risk of information disclosure.

Excerpt language: en.

CVSS3.5v3.1KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:25 WIB

Official record

LowPublished 16 Sep 2025, 16:09 WIB

CVE-2025-10316

Cross-Site Scripting in extension "Form to Database" (form_to_database)

The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.

Excerpt language: en.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated17 Sep 2025, 02:25 WIB

Official record

CritPublished 16 Sep 2025, 15:38 WIB

CVE-2025-4688

SQLi in BGS Interactive's SINAV.LINK Exam Result Module

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BGS Interactive SINAV.LINK Exam Result Module allows SQL Injection. This issue affects SINAV.LINK Exam Result Module: before 1.2.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated05 Jun 2026, 21:46 WIB

Official record

MedPublished 16 Sep 2025, 15:33 WIB

CVE-2025-2404

XSS in Ubit Information Technologies' STOYS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting (XSS). This issue affects STOYS: from 2 before 20250916.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated06 Jun 2026, 13:13 WIB

Official record

UnscoredPublished 16 Sep 2025, 15:11 WIB

CVE-2023-53303

net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule()

In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule() Inject fault When select CONFIG_VCAP_KUNIT_TEST, the below memory leak occurs. If kzalloc() for duprule succeeds, but the following kmemdup() fails, the duprule, ckf and caf memor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:42 WIB

Official record

UnscoredPublished 16 Sep 2025, 15:11 WIB

CVE-2023-53302

wifi: iwl4965: Add missing check for create_singlethread_workqueue()

In the Linux kernel, the following vulnerability has been resolved: wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:42 WIB

Official record

UnscoredPublished 16 Sep 2025, 15:11 WIB

CVE-2023-53301

f2fs: fix kernel crash due to null io->bio

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix kernel crash due to null io->bio We should return when io->bio is null before doing anything. Otherwise, panic. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] Call Tr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:42 WIB

Official record

UnscoredPublished 16 Sep 2025, 15:11 WIB

CVE-2023-53300

media: hi846: Fix memleak in hi846_init_controls()

In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846_init_controls() hi846_init_controls doesn't clean the allocated ctrl_hdlr in case there is a failure, which causes memleak. Add v4l2_ctrl_handler_free to free the resource properly.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2026, 02:42 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage