Server-side request forgery (SSRF) in Dromara MaxKey up to 4.1.7 allows authenticated attackers to make internal network requests via the Meta URL handler. A public exploit exists, but exploitation requires low privileges and no user interaction. EPSS score is low (0.11%), indicating limited active exploitation risk.
Improper authentication in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to access the RTSP live video stream without credentials. A public exploit exists, but no active exploitation has been confirmed and EPSS risk is low.
Cross-site scripting (XSS) in seaswalker spring-analysis up to commit 4379cce allows remote authenticated users to inject arbitrary web scripts via the Name parameter in SimpleController.java. A public exploit exists, but EPSS score is low (0.05%) and no active exploitation has been reported.
Heap-based buffer overflow in HDF5 up to 1.14.6 allows local attackers to execute arbitrary code or cause denial of service via crafted input to the H5F_addr_decode_len function. Public exploit code exists, but no active exploitation in the wild has been confirmed. EPSS score is low (0.05%), indicating limited exploitation likelihood.
Heap-based buffer overflow in libucl up to 0.9.2 allows local attackers to cause a denial of service via crafted input to the ucl_parse_multiline_string function. A public exploit exists, but no active exploitation has been reported and EPSS score is low (0.04%).
Memory leak in HTACG tidy-html5 5.8.0 via the defaultAlloc function in src/alloc.c allows local attackers to cause denial of service by exhausting memory. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.04%), indicating low exploitation likelihood.
A security vulnerability in 70mai M300 (CVSS 3.1). Risk factors: public PoC available.
Exposed root password via unauthenticated HTTP server in 70mai M300 dashcam firmware up to 20250611 allows local network attackers to obtain credentials. Public exploit code exists, but exploitation is difficult and requires local network access. No active exploitation in CISA KEV.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rated low severity (CVSS 2.8). No vendor patch available.
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
A security vulnerability in scan.rs in spytrap-adb (CVSS 2.7). Remediation should follow standard vulnerability management procedures.
xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie store, although this would add substantial complexity, and would not be considered a desirable or expected behavior by all users.) NOTE: this is disputed because integrations of xdg-open typically do not provide information about whether the xdg-open command and arguments were manually entered by a user, or whether they were the result of a navigation from content in an untrusted origin.
A security vulnerability in 70mai 1S (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A security vulnerability in PySpur-Dev pyspur (CVSS 6.3). Remediation should follow standard vulnerability management procedures.
CVE-2025-52937 is a security vulnerability (CVSS 2.0). Remediation should follow standard vulnerability management procedures.
Null pointer dereference in HTACG tidy-html5 5.8.0 allows local attackers to cause a denial of service via the InsertNodeAsParent function in src/parser.c. A public exploit exists, but no active exploitation has been reported. EPSS score is low (0.02%), indicating minimal exploitation risk.
Denial of service in tidy-html5 5.8.0 via reachable assertion in prvTidyParseNamespace allows local attackers to crash the application. A public exploit exists but no active exploitation has been reported; EPSS score is low (0.02%).
Improper authentication in 70mai 1S dashcam up to firmware 20250611 allows local network attackers to access video footage and live streams without credentials. A public exploit exists, but exploitation is difficult due to high attack complexity and local network access requirement. No active exploitation in CISA KEV.