25434 matches found
Amazon Linux 2 : webkitgtk4, --advisory ALAS2-2025-3029 (ALAS-2025-3029)
The version of webkitgtk4 installed on the remote host is prior to 2.48.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3029 advisory. The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macO...
Astra Linux - уязвимость в linux-6.1
In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAXPAGECACHEORDER by commit 099d90642a71 "mm/filemap: make MAXPAGECACHEORD...
JLSEC-2025-40 Header injection/Response splitting via header construction.
HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. using HTTP, Sockets function handleindexreq::HTTP.Request @show HTTP.headerreq, "X-Foo" return HTTP.Response200, "ok" end function handleredirectreq::HTTP.Request retu...
Linux Distros Unpatched Vulnerability : CVE-2021-3907
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OctoRPKI does not escape a URI with a filename containing .., this allows a repository to create a file, ex...
Medium: webkitgtk4
Issue Overview: The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-43272 A correctness issue was address...
EUVD-2025-34071
llama-index has Insecure Temporary File...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
CVE-2025-7707
The CVE-2025-7707 entry concerns llama_index 0.12.33, where NLTK data directory is set to a subdirectory of the codebase, creating a world-writable shared cache and enabling local data tampering, DoS, or privilege escalation. Connected disclosures confirm the issue and point to fixes/upgrades: re...
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
CVE-2025-7707 World-Writable NLTK Cache Directory Vulnerability in run-llama/llama_index
The llamaindex library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, dat...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
CVE-2025-60868
The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...
CVE-2025-61689
HTTP.jl is an HTTP client and server functionality for the Julia programming language. Prior to version 1.10.19, HTTP.jl did not validate header names/values for illegal characters, allowing CRLF-based header injection and response splitting. This enables HTTP response splitting and header...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
webkitgtk: A website may be able to access sensor information without user consent
A flaw was found in WebKitGTK. A malicious website can obtain access to sensor information without user consent due to improper handling of caches...
📄 Packet Storm Missing Cache Header
Packet Storm was missing a cache control header on the user settings page, allowing for parties to click back in a browser post-logout and see the page from the local browser cache. As shared computing situations can allow this to lead to an information disclosure issue, it was immediately...
Huawei EulerOS: Security Advisory for unbound (EulerOS-SA-2025-2218)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
PT-2025-41794
Name of the Vulnerable Software and Affected Versions llama index version 0.12.33 Description The software sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or...
