CISA Flags CVE-2023-0386 as Actively Exploited Linux Kernel Privilege Escalation Threat

CISA Flags CVE-2023-0386 as Actively Exploited Linux Kernel Privilege Escalation Threat

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning about the active exploitation of a critical Linux kernel vulnerability, officially listed as CVE-2023-0386.
The vulnerabilit …
Read more

Published Date:
Jun 18, 2025 (14 hours, 32 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-6029

CVE-2024-26809

CVE-2023-0386

Read More

SSRF Flaw (CVE-2025-6087) in OpenNext for Cloudflare Allows Unauthenticated Content Proxying

SSRF Flaw (CVE-2025-6087) in OpenNext for Cloudflare Allows Unauthenticated Content Proxying

A Server-Side Request Forgery (SSRF) vulnerability has been discovered in the @opennextjs/cloudflare package, potentially allowing unauthenticated users to abuse the /_next/image endpoint to proxy arb …
Read more

Published Date:
Jun 19, 2025 (2 hours, 10 minutes ago)

Vulnerabilities has been mentioned in this article.

CVE-2025-6087

CVE-2023-20126

Read More

CVE-2025-49591 – CryptPad Two-Factor Authentication Path Parameter Bypass

CVE ID : CVE-2025-49591

Published : June 18, 2025, 11:15 p.m. | 2 hours, 47 minutes ago

Description : CryptPad is a collaboration suite. Prior to version 2025.3.0, enforcement of Two-Factor Authentication (2FA) in CryptPad can be trivially bypassed, due to weak implementation of access controls. An attacker that compromises a user’s credentials can gain access to the victim’s account, even if the victim has 2FA set up. This is due to 2FA not being enforced if the path parameter is not 44 characters long, which can be bypassed by simply URL encoding a single character in the path. This issue has been patched in version 2025.3.0.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More

CVE-2025-49590 – CryptPad Link Bouncer JavaScript URI Bypass XSS

CVE ID : CVE-2025-49590

Published : June 18, 2025, 11:15 p.m. | 2 hours, 47 minutes ago

Description : CryptPad is a collaboration suite. Prior to version 2025.3.0, the “Link Bouncer” functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an “early allow” code path that happens before the URI’s protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…

Read More