Author name: UNDERCODE

CVE-2025-6195 is an information disclosure vulnerability in GitLab Enterprise Edition (EE). It affects all versions from 13.7 before 18.4.5, 18.5

This vulnerability allows an authenticated user with specific project permissions to cause a severe denial of service (DoS) condition on

Werkzeug’s safe_join function, used to securely combine path segments, fails to validate Windows-specific device names in versions before 3.1.4. On

CVE-2025-7396 in wolfSSL involves missing blinding support for Curve25519 in specific builds, potentially exposing private keys to side-channel attacks. Blinding

The vulnerability CVE-2025-7394 occurs in wolfSSL’s OpenSSL compatibility layer where the RAND_poll() function fails to properly reinitialize the random number

The vulnerability CVE-2025-66301 in Grav is an authorization bypass that allows a user with basic page editing permissions to escalate

How CVE-2025-65107 works: Langfuse is an open-source LLM engineering platform. The vulnerability affects SSO provider configurations. In versions 2.95.0 to

How the mentioned CVE works: The vulnerability exists in the REDAXO CMS backend’s Mediapool module. When an authenticated backend user

How the CVE Works: This vulnerability exploits a flaw in the OpenID Connect (OIDC) authentication flow of Mattermost. The application

This vulnerability exploits an incomplete security sandbox in Grav CMS’s Twig templating engine. Authenticated users with editor permissions can inject

This vulnerability exploits the trust model between a web browser and a network service. When the Docker MCP Gateway is

How the CVE Works: The vulnerability CVE-2025-13758 in Devolutions Server is an instance of sensitive information disclosure where the server

The CVE-2025-13757 vulnerability is a SQL injection flaw in the last usage logs functionality of Devolutions Server. It arises due

ThingsBoard versions before v4.2.1 contain a stored XSS vulnerability in the Image Gallery. Authenticated users can upload malicious SVG images

The CVE-2025-7915 vulnerability is a critical SQL injection issue in Chanjet CRM version 1.0. It affects the /mail/mailinactive.php file within

How the mentioned CVE works: In Devolutions Server versions before 2025.2.21 and 2025.3.9, a critical authorization flaw allows non-administrative users

How the CVE works: Devolutions Server 2025.3.2 and earlier has a flaw in TLS certificate validation when connecting to gateways.

The vulnerability exists in the GrapesJS-based page builder component of the Aimeos e-commerce CMS extension. Authenticated users with editor privileges

The vulnerability arises in Django’s FilteredRelation feature when used with QuerySet.annotate() or QuerySet.alias() on PostgreSQL databases. When a crafted dictionary

This vulnerability, an Insecure Direct Object Reference (IDOR) combined with an authentication bypass, exists within the Boards feature of Mattermost.

The vulnerability exists within the command-line interface (CLI) of the HPE Aruba Networking Airwave Platform. It stems from improper neutralization

The CVE-2025-7221 vulnerability stems from a missing capability check in the `give_update_payment_status()` function within the GiveWP WordPress plugin. This function

The vulnerability exploits the multipart request handler in Apache Struts. When a specially crafted multipart/form-data request is sent, the framework

How the CVE Works: The vulnerability exists within the `Add Gateway Handler` component of ThingsBoard. It stems from improper neutralization

The vulnerability exists in the access control logic for the `/marketplace/install` and `/marketplace/uninstall` endpoints. Despite a configuration setting to disable

The vulnerability allows an attacker to bypass intended AppArmor or SELinux restrictions in Singularity’s native runtime. When a user runs

The vulnerability resides in the GrapesJS builder component of the Mautic marketing automation platform. This component provides a visual editor

The vulnerability CVE-2024-39829 is a stored Cross-site Scripting (XSS) flaw within the IBM Jazz Foundation reporting component. It arises due

The CVE-2025-51733 is a Cross-Site Request Forgery (CSRF) vulnerability specific to HCL Unica platform version 12.0.0. This vulnerability exists because

How the CVE Works: This CVE is a CSV formula injection vulnerability in HCL Unica’s metrics export feature. When user-controlled

In Apptainer versions before 1.4.5, a vulnerability exists where containers can bypass security enforcement mechanisms. The `–security` option, with forms

How the CVE works: CVE-2025-51734 is a cross-site scripting (XSS) vulnerability in HCL Unica version 12.0.0, specifically within the Metrics

The vulnerability, CVE-2025-13611, stems from an improper access control mechanism within GitLab’s log handling features. Under specific conditions, certain application

How the CVE Works This vulnerability is an unauthenticated file upload flaw in the Metrics component of HCL Unica. The

The vulnerability CVE-2025-33187 resides within the SROOT component of the NVIDIA DGX Spark GB10 platform. SROOT is a privileged system

How the CVE Works: This vulnerability exists in the MediaTek Direct Rendering Manager (DRM) driver within the Linux kernel. During

How the Vulnerability Works: The vulnerability resides in the seed file decryption routine of gokey. A seed file is an

How the mentioned CVE works: This CVE is currently in a reserved state by a CVE Numbering Authority (CNA). Technical

This vulnerability exists within the `intel_quicki2c` kernel module for Intel HID devices. The driver retrieves ICRS and ISUB configuration data

The CVE-2025-39829 vulnerability exists in the Linux kernel’s trace/fgraph subsystem. When user-space writes to the function_profile_enabled interface via sysfs, the

This vulnerability resides within the System Root (SROOT) firmware of the NVIDIA DGX Spark GBX platform. The flaw is an

This vulnerability exists in the `bnxt_en` network driver of the Linux kernel. During an interface shutdown (ifdown), if the firmware

The CVE-2025-39822 vulnerability resides in the io_uring subsystem of the Linux kernel, specifically within the kernel buffer (kbuf) handling code.

The vulnerability exists in the `intel-thc` kernel driver within the `thc_i2c_subip_regs_save()` function. The code incorrectly uses a secondary pointer (&dev->i2c_subip_regs)

The CVE-2025-33188 vulnerability exists in the hardware resource management of NVIDIA DGX Spark GB10 systems. Attackers can exploit insufficient access

How the mentioned CVE works: The vulnerability CVE-2025-33194 targets the SROOT firmware in NVIDIA DGX Spark GB10 systems. SROOT firmware

How the mentioned CVE works: The vulnerability is in the Linux kernel’s fbnic driver. During power management resume, the driver’s

The vulnerability CVE-2025-39820 resides in the Linux kernel’s Direct Rendering Manager (DRM) driver for the MSM Display Processing Unit (DPU).

The vulnerability resides in the `Nemotron_Nano_VL_Config` class within vLLM. When loading a model configuration containing an `auto_map` entry, the class

The CVE-2025-39830 vulnerability is a memory leak in the Linux kernel’s mlx5 hardware steering (HWS) module. It occurs in the

The vulnerability exists in the user creation functionality of Calibre-Web version 0.6.25. When an administrative user creates a new account,

In the Linux kernel’s perf subsystem, a vulnerability arises from improper handling of event groups during throttling. When a group

The CVE-2025-33191 vulnerability exists within the OSROOT firmware of the NVIDIA DGX Spark GB10 platform. This firmware handles critical low-level

The vulnerability occurs in the Linux kernel’s drm/xe/vm subsystem, which manages virtual memory for Intel Xe graphics. During initialization or

How the CVE works: In the Linux kernel’s ice Ethernet driver, a NULL pointer dereference occurs during a PCIe function

The vulnerability stems from a hardcoded default JWT signing secret (“dev”) in the arcade-mcp HTTP server. During server startup via

The vulnerability exists within the SROOT firmware of the NVIDIA DGX Spark GB10 system. SROOT firmware handles low-level system root

How the CVE Works: The vulnerability is in the packet encoding logic of the Eclipse Paho Go MQTT client library

The CVE-2025-33193 vulnerability resides within the SROOT firmware of NVIDIA DGX Spark GB10 systems, specifically involving improper validation of integrity

This vulnerability is a use-after-free flaw within the XML parser of Fade In. When the application processes a malicious `.xml`

The vulnerability CVE-2025-54866 resides in the Wazuh agent for Windows, specifically within versions 4.3.0 to just before 4.13.0. During installation

The vulnerability targets OpenClinica Community Edition versions up to 3.12.2 and 3.13. It resides in the CRF Data Import component,

The vulnerability CVE-2025-62609 in the MLX framework involves a segmentation fault in the `mlx::core::load_gguf()` function when processing malicious GGUF files.

How the CVE works: The vulnerability exists in Wazuh Agent versions prior to 4.13.0. Authenticated attackers can inject malicious UNC

The vulnerability CVE-2025-12875 resides in the `ary_fill_exec` function within mruby’s array extension (array.c). This function handles the `Arrayfill` method. When

A Path Restriction Bypass vulnerability exists in Serv-U software. It allows malicious actors with administrative privileges to execute code on

How the Mentioned CVE Works: The vulnerability exists in the CRF Data Import component of OpenClinica. The `/ImportCRFData?action=confirm` endpoint accepts

How the CVE works: The vulnerability resides in the NR modem’s baseband processing unit, specifically within the Radio Resource Control

How the mentioned CVE works: CVE-2025-61610 exploits improper input validation in the nr modem software stack. The modem fails to

The CVE-2025-40548 vulnerability in SolarWinds Serv U arises from a missing validation process in input handling. Administrative users can submit

The vulnerability exists within the `fim_alert()` function of the Wazuh manager’s analysisd process. This function processes File Integrity Monitoring (FIM)

How the Mentioned CVE Works CVE-2025-36149 is a Clickjacking (UI Redress) vulnerability in IBM Concert. The application fails to implement

In NR modem software, improper input validation in packet processing logic allows remote attackers to cause a system crash. Specifically,

How the CVE works: MLX is a framework for machine learning on Apple silicon. The function mlx::core::load() parses NumPy .npy

How the mentioned CVE works: The vulnerability exists in the MCP Python SDK where DNS rebinding protection is not enabled

The CVE-2025-40547 vulnerability involves a logic error within Serv-U’s administrative functions. This flaw allows an authenticated attacker with administrative privileges

How the mentioned CVE works: The vulnerability exists in the NR modem’s protocol stack software. It involves improper validation of

The vulnerability CVE-2025-53855 is an out-of-bounds write flaw within the XML parser of Fade In version 4.2.0, triggered when processing

How the mentioned CVE works: Twonky Server 8.5.2 exposes a web service API for management. The authentication controls for this

The vulnerability arises from the default configuration of HTTP-based servers in the MCP TypeScript SDK, which lacks DNS rebinding protection.

The vulnerability resides in the /material/getMaterialEnableSerialNumberList endpoint of jishenghua JSH_ERP version 2.3.1. This endpoint accepts a user-controlled ‘search’ query parameter

How the CVE Works: The vulnerability exists in the `/user/addUser` API endpoint of JSH_ERP. This endpoint accepts JSON data that

How the CVE works: The vulnerability resides in the OpenSearch query_string parser. Attackers can submit complex query_string inputs containing deeply

The CVE-2025-51743 vulnerability targets the jishenghua JSH_ERP system version 2.3.1. The flaw resides in the `/materialCategory/addMaterialCategory` endpoint, which insecurely deserializes

The CVE-2025-51745 vulnerability in jishenghua JSH_ERP version 2.3.1 involves insecure deserialization via the `/role/addcan` endpoint, which uses the fastjson library.

How the CVE Works: The vulnerability is a Use-After-Free (UaF) within the kernel-mode drivers for Arm’s Valhall and 5th Gen

In Apache CloudStack, a gap in access control checks affected specific APIs: createNetworkACL, listNetworkACLs, listResourceDetails, listVirtualMachinesUsageHistory, and listVolumesUsageHistory. While these

How CVE-2025-8045 works: This vulnerability is a use-after-free flaw in the Arm Valhall GPU Kernel Driver and Arm 5th Gen

The CVE-2025-51746 vulnerability exploits a insecure deserialization flaw in the fastjson library used by jishenghua JSH_ERP version 2.3.1. Specifically, the

The CVE-2025-58360 vulnerability in GeoServer is an XML External Entity (XXE) flaw that affects versions from 2.26.0 to before 2.26.2

The CVE-2025-59302 vulnerability in Apache CloudStack is a code injection issue that allows administrative users to execute arbitrary code through

How the CVE works: CVE-2025-59789 is a stack overflow vulnerability in Apache bRPC’s json2pb component, affecting versions before 1.15.0. The

How CVE-2025-2879 works: This vulnerability exists in the Arm Valhall GPU Kernel Driver and the Arm 5th Gen GPU Architecture

The CVE-2025-13550 vulnerability is a remote buffer overflow in specific D-Link router models. It affects the firmware version 1.00_20250513164613/1.1.50. The

The vulnerability exists within the `/index.php` file’s login component. The application fails to properly sanitize user input passed to the

The CVE-2025-13576 vulnerability in code-projects Blog Site 1.0 arises from inadequate authorization checks within the /admin.php file. Specific functions in

The vulnerability exists in the `page=city` module of the admin panel (/admin/?page=city). The application fails to properly sanitize user-supplied input

The CVE-2025-13574 vulnerability targets code-projects Online Bidding System 1.0. It involves the /administrator/addcategory.php file. The categoryadd function handles category image

How the CVE works: CVE-2025-13552 is a remote buffer overflow vulnerability in D-Link routers. It targets the formWlEncrypt function in

The vulnerability resides in the `category_exists` function within /resources/functions/blog.php. This function is used to check if a blog category exists.