Critical Vulnerability in Oracle Hospitality OPERA 5 (CVE-2025-21547)
CVE-2025-21547 is a critical flaw in Oracle OPERA 5 allowing remote unauthenticated access to sensitive data or full…
Karl.Fail
Vulnerabilities
Vulnerability notes, technical breakdowns, and security research.
Critical Privilege Escalation in Azure AI Face Service (CVE-2025-21415)
CVE-2025-21415 allows privilege escalation in Azure AI Face Service through authentication bypass by spoofing. Microsoft has issued…
Critical Elevation of Privilege via NTLMv1 in Windows (CVE-2025-21311)
CVE-2025-21311 is a critical flaw in Windows NTLMv1 allowing remote privilege escalation. Patch urgently and disable NTLMv1…
Critical Privilege Escalation in Argo Events via EventSource and Sensor CR (CVE-2025-32445)
CVE-2025-32445 allows privilege escalation in Argo Events via custom EventSource and Sensor CRs. Users should update to v1.9.6…
Critical SQL Injection Vulnerability in TCMAN GIM v11 (CVE-2025-40623)
CVE-2025-40623 is a critical SQL injection flaw in TCMAN GIM v11, allowing unauthenticated attackers to access and manipulate database…
Critical Sandbox Escape in Google Cloud Application Integration (CVE-2025-0982)
CVE-2025-0982 allows sandbox escape via Rhino in Google Cloud Application Integration, enabling remote code execution. Rhino support has been…
Critical OS Command Injection in MicroWorld eScan Antivirus (CVE-2025-0798)
A critical OS Command Injection vulnerability (CVE-2025-0798) affects MicroWorld eScan Antivirus 7.0.32 for Linux. Remote exploitation is…
CVE-2025-0159: Authentication Bypass in IBM FlashSystem (Storage Virtualize)
CVE-2025-0159 is a critical flaw in IBM FlashSystem allowing unauthenticated access via crafted RPC…
CVE-2025-0070: Critical Improper Authentication in SAP NetWeaver ABAP Server
CVE-2025-0070 is a critical authentication flaw in SAP NetWeaver ABAP, allowing privilege escalation via improper…
CVE-2025-27429: Critical ABAP Code Injection in SAP S/4HANA via RFC
CVE-2025-27429 is a critical ABAP code injection flaw in SAP S/4HANA that allows low-privileged attackers to fully compromise the system via…
CVE-2025-27519: Critical Path Traversal Vulnerability in Cognita RAG Framework
CVE-2025-27519 is a critical path traversal flaw in Cognita that allows remote code execution via arbitrary file writes in Docker…
CVE-2025-27816: Critical Deserialization Vulnerability in Arctera InfoScale
CVE-2025-27816 is a critical deserialization vulnerability in Arctera InfoScale that allows remote code execution via the Plugin_Host…