Transmission of Private Resources into a New Sphere

Every one of the 23 is a mark on the map. Named now: 1 to 23, most at risk first.

1. XWiki REST API - Private Pages DisclosureCVE-2025-29925xwiki · CVSS 8.7 · 0.9% likely

   Xwiki

2. Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19CVE-2021-31407Vaadin · CVSS 8.6 · 2.4% likely

   Vaadin

3. Project sources exposure in Vaadin DesignerCVE-2021-31410Vaadin · CVSS 8.6 · 1.8% likely

   Vaadin

4. Transmission of Private Resources into a New Sphere ('Resource Leak') in Crafter EngineCVE-2021-23263Crafter Software · CVSS 5.9 · 1.7% likely

   Crafter Software

5. Transmission of Private Resources into a New Sphere ('Resource Leak') and Exposure of Resource to Wrong Sphere in Crafter SearchCVE-2021-23264Crafter Software · CVSS 8.1 · 1.2% likely

   Crafter Software

6. Instack-undercloud: rsync leaks information to undercloudCVE-2022-3596Red Hat · CVSS 7.5 · 1.1% likely

   Red Hat

7. Due to a firewall misconfiguration, Kerlink devices running KerOS prior to 5.12 incorrectly accept specially crafted UDP packets. This allows an attacker to bypass the firewall an…CVE-2024-32388Kerlink · CVSS 5.3 · 1.0% likely
8. XWiki Platform may retrieve email addresses of all usersCVE-2023-34467xwiki · CVSS 7.5 · 1.0% likely

   Xwiki

9. Elasticsearch X-Pack Security versions 5.0.0 to 5.4.3, when enabled, can result in the Elasticsearch _nodes API leaking sensitive configuration information, such as the paths and…CVE-2017-8442Elastic · 0.9% likely

   Elastic

10. XWiki Platform's obfuscated email addresses should not be sortedCVE-2023-38509xwiki · CVSS 4.3 · 0.8% likely

    Xwiki

11. @electron/packager's build process memory potentially leaked into final executableCVE-2024-29900electron · CVSS 7.5 · 0.6% likely

    Electron

12. A vulnerability has been identified in SICAM GridEdge (Classic) (All versions < V2.6.6). The affected application discloses password hashes of other users upon request. This could…CVE-2022-30231Siemens · CVSS 4.9 · 0.6% likely

    Siemens

13. Transmission of Private Resources into a New Sphere in Crafter EngineCVE-2025-0502CrafterCMS · CVSS 6.9 · 0.5% likely

    Craftercms

14. The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and dict.cn servers via…CVE-2025-55014StarDict · CVSS 4.7 · 0.4% likely
15. In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint.CVE-2025-49618Plesk · CVSS 5.8 · 0.4% likely

    Plesk

16. Django-Select2 Vulnerable to Widget Instance Secret Cache Key LeakingCVE-2025-48383codingjoe · CVSS 8.2 · 0.3% likely
17. Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.CVE-2025-66422Tryton · CVSS 4.3 · 0.3% likely

    Tryton

18. Ruijie Reyee OS Resource LeakCVE-2024-47146Ruijie · CVSS 6.5 · 0.3% likely

    Ruijie

19. Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.cCVE-2023-4569Linux · CVSS 5.5 · 0.3% likely

    Linux

20. In Zammad 6.4.x before 6.4.2, there is information exposure. Only agents should be able to see and work on shared article drafts. However, a logged in customer was able to see det…CVE-2025-32360Zammad · CVSS 4.2 · 0.3% likely

    Zammad

21. Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.CVE-2024-0443Redhat · CVSS 5.5 · 0.2% likely

    Red Hat

22. In One Identity OneLogin Active Directory Connector before 6.1.5, encryption of the DirectoryToken was mishandled, aka ST-812.CVE-2025-52925OneLogin · CVSS 5 · 0.2% likely

    OneLogin

23. Myhoard logs backup encryption key in plain textCVE-2025-67745Aiven-Open · CVSS 7.1 · 0.2% likely

    Aiven-Open

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.