Heimdall Data Database Proxy 跨站脚本漏洞

Heimdall Data Database Proxy is an intelligent database proxy from Heimdall Data, Inc. A cross-site scripting vulnerability exists in Heimdall Data Database Proxy that stems from a lack of validation of user-supplied data in database event log processing, which could lead to arbitrary script...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990492)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990492 advisory. In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it ...

CVE-2025-64326: Improper Removal of Sensitive Information Before Storage or Transfer

Weblate is a web based localization tool. In versions 5.14 and below, Weblate leaks the IP address of the project member inviting the user to the project in the audit log. The audit log includes IP addresses from admin-triggered actions, which can be viewed by invited users. This issue is fixed i...

Updated mediawiki packages fix security vulnerabilities

i18n XSS vulnerability in HTMLMultiSelectField when sections are used. CVE-2025-3469 "reupload-own" restriction can be bypassed by reverting file. CVE-2025-32696 Cascading protection is not preventing file reversions. CVE-2025-32697 LogPager.php: Restriction enforcer functions do not correctly...

MGASA-2025-0260 Updated mediawiki packages fix security vulnerabilities

i18n XSS vulnerability in HTMLMultiSelectField when sections are used. CVE-2025-3469 "reupload-own" restriction can be bypassed by reverting file. CVE-2025-32696 Cascading protection is not preventing file reversions. CVE-2025-32697 LogPager.php: Restriction enforcer functions do not correctly...

GHSA-GR35-VPX2-QXHC Weblate leaks the IP of project member inviting user to be reviewer in Audit log

Summary Weblate leaks the IP address of the project member inviting the user to the project in the audit log. Details The audit log included IP addresses from admin-triggered actions, and those could be viewed by invited users. Impact The inviting user's admin's IP address could be leaked to...

GO-2025-4000 Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd

Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...

Buffer Overflow

CodeChecker is vulnerable to Buffer Overflow. The vulnerability is due to unsafe handling of input when executing the CodeChecker log command, and attackers can exploit this by supplying crafted log data to cause memory corruption and potentially achieve code execution...

Cross-site Scripting (XSS)

s-cart/core and gp247/core are vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of the User-Agent header in the Admin Log Viewer, which allows an attacker to inject malicious scripts that execute in an administrator’s browser when viewing the security log...

CVE-2025-12582

creationtimestamp| type| source ---|---|--- 2025-11-05 06:42:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m4uh2annri2s...

CVE-2025-11008

The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as oth...

CVE-2025-43477

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be able to access sensitive user data...

PT-2025-45805

Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function in github.com/canonical/lxd...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988653)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988653 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak in addinoderef Line 1169 3 allocates a memory chunk for victimname by...

WordPress Post SMTP plugin Unauthorized Access to Data Vulnerability

WordPress Post SMTP plugin is a tool for solving WordPress website email sending problems, which realizes email sending through SMTP protocol and avoids emails that can't be sent or marked as spam due to server limitations. WordPress Post SMTP plugin suffers from an unauthorized access to data...

About the security content of iOS 18.7.2 and iPadOS 18.7.2

About the security content of iOS 18.7.2 and iPadOS 18.7.2 This document describes the security content of iOS 18.7.2 and iPadOS 18.7.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989857)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989857 advisory. In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITSPERLONG The code in dm-log rounds up bitsetsize...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988747)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988747 advisory. In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITSPERLONG The code in dm-log rounds up bitsetsize...

PT-2025-45725

Summary Weblate leaks the IP address of the project member inviting the user to the project in the audit log. Details The audit log included IP addresses from admin-triggered actions, and those could be viewed by invited users. Impact The inviting user's admin's IP address could be leaked to...

Information Disclosure

OpenBao is vulnerable to an Information Disclosure Vulnerability. The vulnerability is due to a regression in audit log redaction, where raw HTTP request bodies for ACME and OIDC issuer endpoints are not properly HMAC-redacted, allowing short-lived ACME verification codes, authentication response...