Heap-based buffer overflow in libucl up to 0.9.2 allows local attackers to cause a denial of service via crafted input to the ucl_parse_multiline_string function. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Memory leak in HTACG tidy-html5 5.8.0 via the defaultAlloc function in src/alloc.c allows local attackers to cause denial of service by exhausting memory. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.04%), indicating low exploitation likelihood.
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
A security vulnerability in WhiteBeam 0.2.0 (CVSS 5.7). Remediation should follow standard vulnerability management procedures.
In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Out-of-bounds Read vulnerability in dail8859 NotepadNext (src/lua/src modules). This vulnerability is associated with program files lparser.C. This issue affects NotepadNext: through v0.11. The singlevar() in lparser.c lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
An issue in NCR Terminal Handler 1.5.1 allows a low-level privileged authenticated attacker to query the SOAP API endpoint to obtain information about all of the users of the application including their usernames, roles, security groups and account statuses.
An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry. Due to flawed authorization logic, a malicious actor with access to the management console can exploit a specific bypass method to retrieve versioned files without proper authorization. Successful exploitation of this vulnerability could lead to unauthorized disclosure of configuration or resource files that may be stored as registry versions, potentially aiding further attacks or system reconnaissance.
In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated low severity (CVSS 2.8). No vendor patch available.
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
A security vulnerability in scan.rs in spytrap-adb (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
A security vulnerability in 70mai 1S (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in PySpur-Dev pyspur (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-52937 is a security vulnerability (CVSS 2.0). Remediation should follow standard vulnerability management procedures.
Null pointer dereference in HTACG tidy-html5 5.8.0 allows local attackers to cause a denial of service via the InsertNodeAsParent function in src/parser.c. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.02%), indicating minimal exploitation risk.
Denial of service in tidy-html5 5.8.0 via reachable assertion in prvTidyParseNamespace allows local attackers to crash the application. A public exploit exists but no active exploitation has been reported; EPSS score is low (0.02%).
Improper authentication in 70mai 1S dashcam up to firmware 20250611 allows local network attackers to access video footage and live streams without credentials. A public exploit exists, but exploitation is difficult due to high attack complexity and local network access requirement. No active exploitation in CISA KEV.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.