CVE-2026-21855

Overview

the-hideout
tarkov-data-manager

07 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

CRITICAL (9.3)

EPSS

Pending

MITRE

KEV

Description

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of a victim's browser session by crafting a malicious URL. A series of fix commits on 02 January 2025 fixed this and other vulnerabilities.

Statistics

1 Post

Last activity: 5 hours ago

Fediverse

TheHackerWire @thehackerwire

🔴 CVE-2026-21855 - Critical (9.3)

The Tarkov Data Manager is a tool to manage the Tarkov item data. Prior to 02 January 2025, a reflected Cross Site Scripting (XSS) vulnerability in the toast notification system allows any attacker to execute arbitrary JavaScript in the context of...

🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-21855/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
5h ago

CVE-2025-47345

Overview

Qualcomm, Inc.
Snapdragon

06 Jan 2026

Published

07 Jan 2026

Updated

CVSS v3.1

HIGH (8.4)

EPSS

0.01%

MITRE

KEV

Description

Cryptographic issue may occur while encrypting license data.

Statistics

1 Post

Last activity: 11 hours ago

Fediverse

TheHackerWire @thehackerwire

🟠 CVE-2025-47345 - High (8.4)

Cryptographic issue may occur while encrypting license data.

🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-47345/

#CVE #vulnerability #infosec #cybersecurity #security #Tenda

0
0
0
11h ago

CVE-2007-0671

Overview

Pending

03 Feb 2007

Published

22 Oct 2025

Updated

CVSS

Pending

EPSS

66.16%

MITRE

KEV

Description

Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.

Statistics

2 Posts
3 Interactions

Last activity: Last hour

Fediverse

Ravi Nayyar @ravirockks

'In 2025, the number of vulnerabilities from 2024 and earlier added to the catalog grew to 94, a 34% increase from a year earlier.

'The oldest vulnerability added to the KEV catalog in 2025 was CVE-2007-0671, a Microsoft Office Excel Remote Code Execution vulnerability.

'The oldest vulnerability in the catalog remains one from 2002 – CVE-2002-0367, a privilege escalation vulnerability in the Windows NT and Windows 2000 smss.exe debugging subsystem that has been known to be used in ransomware attacks'.
https://cyble.com/blog/cisa-kev-2025-exploited-vulnerabilities-growth/

2
1
1
Last hour

CVE-2025-59468

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

2 Posts

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

Veeam has released an update for its Backup & Replication solution to patch several remote code execution vulnerabilities (CVE-2025-59470, CVE-2025-55125, CVE-2025-59469, CVE-2025-59468). These flaws, discovered internally by Veeam, affect version 13.0.1.180 and earlier, and while not reported as exploited in the wild, they require privileged access for exploitation and have been assigned high severity ratings.
https://www.securityweek.com/several-code-execution-flaws-patched-in-veeam-backup-replication/

0
0
0
11h ago

Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Multiple Veeam CVEs Identified: Critical Flaws Allow RCE and High-Privilege Actions

CVE-2025-55125:

A flaw that allows a Backup or Tape Operator to achieve remote code execution (RCE) as root by crafting a malicious backup configuration file.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59468:

A vulnerability enabling a Backup Administrator to execute remote code as the postgres user by supplying a malicious password parameter.

▪️Severity: Medium
▪️CVSS v3.1: 6.7
▪️Source: Discovered during internal testing

CVE-2025-59469

A security issue that allows a Backup or Tape Operator to write arbitrary files with root privileges.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59470

A vulnerability that permits a Backup or Tape Operator to achieve remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

▪️CVSS Severity: Critical
▪️CVSS v3.1: 9.0
▪️Source: Discovered during internal testing

Veeam: https://www.veeam.com/kb4738
Blog format: https://darkwebinformer.com/multiple-veeam-cves-identified-critical-flaws-allow-rce-and-high-privilege-actions/

0
0
0
9h ago

CVE-2025-67268

Overview

Pending

02 Jan 2026

Published

06 Jan 2026

Updated

CVSS

Pending

EPSS

0.07%

MITRE

KEV

Description

gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file. The hnd_129540 function, which handles NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to validate the user-supplied satellite count against the size of the skyview array (184 elements). This allows an attacker to write beyond the bounds of the array by providing a satellite count up to 255, leading to memory corruption, Denial of Service (DoS), and potentially arbitrary code execution.

Statistics

1 Post

Last activity: 6 hours ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

Just published a detailed analysis of the new gpsd security advisories for #openSUSE Tumbleweed (CVE-2025-67268 & CVE-2025-67269). Read more: 👉 tinyurl.com/5cvdahzb #Security

0
0
0
6h ago

CVE-2025-67269

Overview

Pending

02 Jan 2026

Published

06 Jan 2026

Updated

CVSS

Pending

EPSS

0.05%

MITRE

KEV

Description

An integer underflow vulnerability exists in the `nextstate()` function in `gpsd/packet.c` of gpsd versions prior to commit `ffa1d6f40bca0b035fc7f5e563160ebb67199da7`. When parsing a NAVCOM packet, the payload length is calculated using `lexer->length = (size_t)c - 4` without checking if the input byte `c` is less than 4. This results in an unsigned integer underflow, setting `lexer->length` to a very large value (near `SIZE_MAX`). The parser then enters a loop attempting to consume this massive number of bytes, causing 100% CPU utilization and a Denial of Service (DoS) condition.

Statistics

1 Post

Last activity: 6 hours ago

Bluesky

ferramentaslinux.bsky.social @ferramentaslinux.bsky.social

Just published a detailed analysis of the new gpsd security advisories for #openSUSE Tumbleweed (CVE-2025-67268 & CVE-2025-67269). Read more: 👉 tinyurl.com/5cvdahzb #Security

0
0
0
6h ago

CVE-2025-55125

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

2 Posts

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

Veeam has released an update for its Backup & Replication solution to patch several remote code execution vulnerabilities (CVE-2025-59470, CVE-2025-55125, CVE-2025-59469, CVE-2025-59468). These flaws, discovered internally by Veeam, affect version 13.0.1.180 and earlier, and while not reported as exploited in the wild, they require privileged access for exploitation and have been assigned high severity ratings.
https://www.securityweek.com/several-code-execution-flaws-patched-in-veeam-backup-replication/

0
0
0
11h ago

Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Multiple Veeam CVEs Identified: Critical Flaws Allow RCE and High-Privilege Actions

CVE-2025-55125:

A flaw that allows a Backup or Tape Operator to achieve remote code execution (RCE) as root by crafting a malicious backup configuration file.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59468:

A vulnerability enabling a Backup Administrator to execute remote code as the postgres user by supplying a malicious password parameter.

▪️Severity: Medium
▪️CVSS v3.1: 6.7
▪️Source: Discovered during internal testing

CVE-2025-59469

A security issue that allows a Backup or Tape Operator to write arbitrary files with root privileges.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59470

A vulnerability that permits a Backup or Tape Operator to achieve remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

▪️CVSS Severity: Critical
▪️CVSS v3.1: 9.0
▪️Source: Discovered during internal testing

Veeam: https://www.veeam.com/kb4738
Blog format: https://darkwebinformer.com/multiple-veeam-cves-identified-critical-flaws-allow-rce-and-high-privilege-actions/

0
0
0
9h ago

CVE-2025-59469

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

2 Posts

Last activity: 9 hours ago

Fediverse

ekiledjian @edwardk

Veeam has released an update for its Backup & Replication solution to patch several remote code execution vulnerabilities (CVE-2025-59470, CVE-2025-55125, CVE-2025-59469, CVE-2025-59468). These flaws, discovered internally by Veeam, affect version 13.0.1.180 and earlier, and while not reported as exploited in the wild, they require privileged access for exploitation and have been assigned high severity ratings.
https://www.securityweek.com/several-code-execution-flaws-patched-in-veeam-backup-replication/

0
0
0
11h ago

Dark Web Informer :verified_paw: @DarkWebInformer

🚨 Multiple Veeam CVEs Identified: Critical Flaws Allow RCE and High-Privilege Actions

CVE-2025-55125:

A flaw that allows a Backup or Tape Operator to achieve remote code execution (RCE) as root by crafting a malicious backup configuration file.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59468:

A vulnerability enabling a Backup Administrator to execute remote code as the postgres user by supplying a malicious password parameter.

▪️Severity: Medium
▪️CVSS v3.1: 6.7
▪️Source: Discovered during internal testing

CVE-2025-59469

A security issue that allows a Backup or Tape Operator to write arbitrary files with root privileges.

▪️Severity: High
▪️CVSS v3.1: 7.2
▪️Source: Discovered during internal testing

CVE-2025-59470

A vulnerability that permits a Backup or Tape Operator to achieve remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter.

▪️CVSS Severity: Critical
▪️CVSS v3.1: 9.0
▪️Source: Discovered during internal testing

Veeam: https://www.veeam.com/kb4738
Blog format: https://darkwebinformer.com/multiple-veeam-cves-identified-critical-flaws-allow-rce-and-high-privilege-actions/

0
0
0
9h ago

CVE-2025-13034

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post
31 Interactions

Last activity: 17 hours ago

Fediverse

Harry Sintonen @harrysintonen

#curl 8.18.0 has been released. This release fixes 2 medium and 4 low level vulnerabilities:
- CVE-2025-13034: No QUIC certificate pinning with GnuTLS https://curl.se/docs/CVE-2025-13034.html
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from https://curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

18
13
0
17h ago

CVE-2025-14819

Overview

Pending

Pending

Published

Pending

Updated

CVSS

Pending

EPSS

Pending

MITRE

KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

1 Post
31 Interactions

Last activity: 17 hours ago

Fediverse

Harry Sintonen @harrysintonen

#curl 8.18.0 has been released. This release fixes 2 medium and 4 low level vulnerabilities:
- CVE-2025-13034: No QUIC certificate pinning with GnuTLS https://curl.se/docs/CVE-2025-13034.html
- CVE-2025-14017: broken TLS options for threaded LDAPS https://curl.se/docs/CVE-2025-14017.html
- CVE-2025-14524: bearer token leak on cross-protocol redirect https://curl.se/docs/CVE-2025-14524.html
- CVE-2025-14819: OpenSSL partial chain store policy bypass https://curl.se/docs/CVE-2025-14819.html
- CVE-2025-15079: libssh global knownhost override https://curl.se/docs/CVE-2025-15079.html
- CVE-2025-15224: libssh key passphrase bypass without agent set https://curl.se/docs/CVE-2025-15224.html

I discovered the last 2 vulnerabilities.

Download curl 8.18.0 from https://curl.se/download.html

#vulnerabilityresearch #vulnerability #cybersecurity #infosec

18
13
0
17h ago