Security Vulnerabilities
A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal.
CVSS Score
6.5
EPSS Score
0.001
Published
2025-12-10
Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing unauthenticated attackers to cause a denial of service.
CVSS Score
7.5
EPSS Score
0.001
Published
2025-12-10
DataGear v5.5.0 is vulnerable to Arbitrary File Deletion.
CVSS Score
9.1
EPSS Score
0.001
Published
2025-12-10
An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying a crafted PSD file.
CVSS Score
6.5
EPSS Score
0.0
Published
2025-12-10
An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command.
CVSS Score
8.4
EPSS Score
0.0
Published
2025-12-10
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAIDP.DLL from its installation directory without sufficient integrity validation or a secure search order. A local attacker with write access to that directory can plant a malicious MEAIDP.DLL, which is then loaded on execution, resulting in attacker-controlled code running with the privileges of the process.
CVSS Score
7.8
EPSS Score
0.0
Published
2025-12-10
Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.6369_B20230113 (arbitrary command execution). Earlier versions that share the same implementation, may also be affected.
CVSS Score
9.8
EPSS Score
0.001
Published
2025-12-10
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
CVSS Score
9.8
EPSS Score
0.001
Published
2025-12-10
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
CVSS Score
9.8
EPSS Score
0.001
Published
2025-12-10
Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion.
This issue affects Apache Struts: from 2.0.0 through 6.7.4, from 7.0.0 through 7.0.3.
Users are recommended to upgrade to version 6.8.0 or 7.1.1, which fixes the issue.
It's related to https://cve.org/CVERecord?id=CVE-2025-64775 - this CVE addresses missing affected version 6.7.4
CVSS Score
8.2
EPSS Score
0.001
Published
2025-12-10