24h | 7d | 30d

CVE-2025-54512

Overview

  • AMD
  • AMD Ryzen™ Master
11 Aug 2026
Published
11 Aug 2026
Updated
CVSS v4.0
HIGH (7.0)
EPSS
Pending
KEV

Description

A DLL hijacking vulnerability within the AMD Ryzen Master installation could allow a local user-privileged attacker to escalate privileges, potentially resulting in arbitrary code execution.

Statistics

  • 1 Post
Last activity: 9 hours ago

Bluesky

Profile picture fallback
ohhara @shiojiri.com
AMD Ryzen Masterに任意のコード実行などの脆弱性。CVE-2025-54512とCVE-2026-0465 | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/post-131554.html
  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-0465

Overview

  • AMD
  • AMD Ryzen™ Master
11 Aug 2026
Published
11 Aug 2026
Updated
CVSS v4.0
MEDIUM (5.6)
EPSS
Pending
KEV

Description

A Use‑After‑Free (UAF) vulnerability in the AMD Ryzen™ Master Utility Driver could allow a local attacker to access kernel memory, potentially resulting in loss of availability

Statistics

  • 1 Post
Last activity: 9 hours ago

Bluesky

Profile picture fallback
ohhara @shiojiri.com
AMD Ryzen Masterに任意のコード実行などの脆弱性。CVE-2025-54512とCVE-2026-0465 | ニッチなPCゲーマーの環境構築Z https://www.nichepcgamer.com/archives/post-131554.html
  • 0
  • 0
  • 0
  • 9h ago

CVE-2026-72916

Overview

  • mastodon
  • mastodon
10 Aug 2026
Published
10 Aug 2026
Updated
CVSS v4.0
MEDIUM (6.3)
EPSS
0.36%
KEV

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.private_address? in app/lib/private_address_check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. An attacker could supply an address in the omitted range to bypass the ALLOWED_PRIVATE_ADDRESSES protection and make Mastodon send HTTP requests to loopback interfaces, potentially accessing private resources and services. Exploitation requires a system that supports the obsolete IPv4-compatible IPv6 mechanism. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Harald Hannelius :verified: @harald

Vulnerabilities in #Mastodon
URL: github.com/mastodon/mastodon/s
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5
CVEs: CVE-2026-72914, CVE-2026-72915, CVE-2026-72916
See also:
- github.com/mastodon/mastodon/s
- github.com/mastodon/mastodon/s

CVE-2026-72914 (CVSS: 7.5): A Mastodon statistics endpoint intended for
instance administrators was checking for the appropriate permissions before
returning the results, but not before computing them, allowing anyone to issue
potentially expensive requests.

CVE-2026-72915 (CVSS: 7.5): Mastodon versions 4.6.0 to 4.6.4 allow any
logged-in local user to access personally-identifying information about other
local-users due to an incorrect access control validation.

CVE-2026-72916 (CVSS: 6.3): By nature, Mastodon performs a lot of outbound
requests to user-provided domains. Mastodon however has some protection
mechanism to disallow requests to local IP addresses (unless specified in
ALLOWED_PRIVATE_ADDRESSES) to avoid the “confused deputy” problem. The list of
disallowed IP address ranges was lacking the IPv4-compatible IPv6 address
range that can be used to reach local IP addresses on specific configurations.

  • 1
  • 0
  • 0
  • 6h ago

CVE-2026-72914

Overview

  • mastodon
  • mastodon
10 Aug 2026
Published
11 Aug 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.45%
KEV

Description

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Harald Hannelius :verified: @harald

Vulnerabilities in #Mastodon
URL: github.com/mastodon/mastodon/s
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5
CVEs: CVE-2026-72914, CVE-2026-72915, CVE-2026-72916
See also:
- github.com/mastodon/mastodon/s
- github.com/mastodon/mastodon/s

CVE-2026-72914 (CVSS: 7.5): A Mastodon statistics endpoint intended for
instance administrators was checking for the appropriate permissions before
returning the results, but not before computing them, allowing anyone to issue
potentially expensive requests.

CVE-2026-72915 (CVSS: 7.5): Mastodon versions 4.6.0 to 4.6.4 allow any
logged-in local user to access personally-identifying information about other
local-users due to an incorrect access control validation.

CVE-2026-72916 (CVSS: 6.3): By nature, Mastodon performs a lot of outbound
requests to user-provided domains. Mastodon however has some protection
mechanism to disallow requests to local IP addresses (unless specified in
ALLOWED_PRIVATE_ADDRESSES) to avoid the “confused deputy” problem. The list of
disallowed IP address ranges was lacking the IPv4-compatible IPv6 address
range that can be used to reach local IP addresses on specific configurations.

  • 1
  • 0
  • 0
  • 6h ago

CVE-2026-72915

Overview

  • mastodon
  • mastodon
10 Aug 2026
Published
11 Aug 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.28%
KEV

Description

Mastodon is a free, open-source social network server based on ActivityPub. From 4.6.0-beta.1 until 4.6.4 and 4.7.0-beta.1, any logged-in local user could use the show action in app/controllers/admin/collections_controller.rb to access personally identifying information about another local user in a collection because the controller used the general collection policy instead of the admin collection policy namespace. The exposed data included the other user's current email address and last-used IP address. This issue is fixed in versions 4.6.4 and 4.7.0-beta.1.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 6 hours ago

Fediverse

Profile picture fallback
Harald Hannelius :verified: @harald

Vulnerabilities in #Mastodon
URL: github.com/mastodon/mastodon/s
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5
CVEs: CVE-2026-72914, CVE-2026-72915, CVE-2026-72916
See also:
- github.com/mastodon/mastodon/s
- github.com/mastodon/mastodon/s

CVE-2026-72914 (CVSS: 7.5): A Mastodon statistics endpoint intended for
instance administrators was checking for the appropriate permissions before
returning the results, but not before computing them, allowing anyone to issue
potentially expensive requests.

CVE-2026-72915 (CVSS: 7.5): Mastodon versions 4.6.0 to 4.6.4 allow any
logged-in local user to access personally-identifying information about other
local-users due to an incorrect access control validation.

CVE-2026-72916 (CVSS: 6.3): By nature, Mastodon performs a lot of outbound
requests to user-provided domains. Mastodon however has some protection
mechanism to disallow requests to local IP addresses (unless specified in
ALLOWED_PRIVATE_ADDRESSES) to avoid the “confused deputy” problem. The list of
disallowed IP address ranges was lacking the IPv4-compatible IPv6 address
range that can be used to reach local IP addresses on specific configurations.

  • 1
  • 0
  • 0
  • 6h ago

CVE-2025-41769

Overview

  • Phoenix Contact
  • AXC F 1152
12 Aug 2026
Published
12 Aug 2026
Updated
CVSS v4.0
CRITICAL (9.3)
EPSS
Pending
KEV

Description

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or execute arbitrary code.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

certvde.com/en/advisories/vde-

phoenixcontact.csaf-tp.certvde

  • 0
  • 1
  • 0
  • 4h ago

CVE-2025-41770

Overview

  • Phoenix Contact
  • AXC F 1152
12 Aug 2026
Published
12 Aug 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
Pending
KEV

Description

An unauthenticated denial-of-service vulnerability in the device's PLCnext Engineer communication interface allow an remote attacker to interrupt access via the client application. Successful exploitation prevents communication until the PLCnext service is manually restarted.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

certvde.com/en/advisories/vde-

phoenixcontact.csaf-tp.certvde

  • 0
  • 1
  • 0
  • 4h ago

CVE-2025-41771

Overview

  • Phoenix Contact
  • AXC F 1152
12 Aug 2026
Published
12 Aug 2026
Updated
CVSS v4.0
MEDIUM (5.3)
EPSS
Pending
KEV

Description

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

Statistics

  • 1 Post
  • 1 Interaction
Last activity: 4 hours ago

Fediverse

Profile picture fallback
CERT@VDE @certvde

VDE-2025-056
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware

This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queries. Successful exploitation could impact the availability, integrity, and confidentiality of affected PLCnext Control devices. All issues are resolved in PLCnext firmware version 2026.0.3.
CVE-2025-41769, CVE-2025-41770, CVE-2025-41771

certvde.com/en/advisories/vde-

phoenixcontact.csaf-tp.certvde

  • 0
  • 1
  • 0
  • 4h ago

CVE-2026-21655

Overview

  • Johnson Control
  • victor
23 Jul 2026
Published
06 Aug 2026
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.16%
KEV

Description

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

Statistics

  • 1 Post
Last activity: 16 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
~Cisa~ Critical RCE, SSRF, and privilege escalation vulnerabilities in Johnson Controls C-CURE 9000 and Victor enable unauthenticated adjacent-network attackers to execute arbitrary code. - IOCs: CVE-2026-21655, CVE-2026-21653, CVE-2026-34496 - ...
  • 0
  • 0
  • 0
  • 16h ago

CVE-2026-62893

Overview

  • Microsoft
  • Windows 10 Version 1607
11 Aug 2026
Published
12 Aug 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.

Statistics

  • 1 Post
Last activity: 8 hours ago

Bluesky

Profile picture fallback
boredchilada @cyfar.ca
@talosintelligence.com Microsoft's August 2026 update patches 421 vulnerabilities, including 62 critical and one actively exploited EoP flaw (CVE-2026-68820). - IOCs: CVE-2026-68820, CVE-2026-62893, CVE-2026-62878 - #CVE #PatchTuesday #ThreatIntel
  • 0
  • 0
  • 0
  • 8h ago
Showing 71 to 80 of 83 CVEs