CVE-2025-27210_NodeJS_Path_Traversal_Exploit

CVE-2025-27210NodeJSPathTraversalExploiter Proof of Concept CVE-2025-27210, a precise Path Traversal vulnerability affecting Node.js applications running on Microsoft Windows. This vulnerability leverages the specific way Windows handles reserved device file names e.g., AUX, CON, NUL when combine...

CVE-2022-39197

CVE-2022-39197 CVE-2022-39197 "ID": "CVE-2022-39197", "STATE": "RESERVED"...

EUVD-2026-79285

Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset controller action cleared the administrator-configured reserved-word list concrete.seo.excludewords but did not validate the anti-CSRF token that the reset modal emitted, and ...

socialscan

socialscan socialscan offers accurate and fast checks for email address and username usage on online platforms. Given an email address or username, socialscan returns whether it is available, taken or invalid on online platforms. Features that differentiate socialscan from similar tools e.g...

Astra Linux – Vulnerability in p7zip

7-Zip 22.01 does not report an error for certain invalid xz files that involve stream flags and reserved bits. Some later versions are unaffected...

CVE-2023-24287

Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Undead puzzle , triggerable via the "M" command when loading a crafted save file. The vulnerability results in a low availability impact (CVSS 3.1 base score 2.9 , local attack vector with h...

CVE-2023-24288

Simon Tatham's Portable Puzzle Collection (sgt-puzzles) is vulnerable to a buffer overrun triggered by a crafted save file, which can lead to Denial of Service . The vulnerability affects versions before 20230116.5782e29 . The CVSS 3.1 score is 2.9 (LOW) , with a local attack vector, high complex...

CVE-2023-45023

femanager (version 7, before 7.2.2 ) is a TYPO3 extension used for frontend user account management. The vulnerability stems from a missing permission check in the invitation component , allowing a remote user with low privileges to create frontend user accounts with access to configured frontend...

CVE-2023-24284

Portable Puzzle Collection (sgt-puzzles) versions before 20230116.5782e29 contain a buffer overflow in the Guess puzzle , triggered via the is_markable() function when processing a crafted save file . The vulnerability was fixed upstream in commit 5279fd2, but Ubuntu reports no vendor-supplied pa...

CVE-2023-32803

The ca-certificates package on Amazon Linux 2 , Amazon Linux 2023 , and Amazon Linux AMI failed to properly remove certain TrustCor root certificates from the trust store. The flaw stems from an incorrect initial fix for CVE-2022-23491 . A remote attacker could potentially leverage the unremoved ...

CVE-2023-46035

CVE-2023-46035 affects the svg_optimizer Ruby gem (versions before 0.3.0 , specifically v0.2.6), an SVG optimization library based on Node's SVGO. The vulnerability is an XML External Entity (XXE) injection caused by allowing entity expansion by default when parsing untrusted SVG documents. A rem...

CVE-2023-50462

The Content Consent (content_consent) extension for TYPO3 , versions through 2.0.1 , suffers from an Insecure Direct Object Reference (IDOR) . The plugin fails to verify whether a specified content element identifier is permitted, allowing an unauthenticated user to display various content elemen...

CVE-2023-50461

CVE-2023-50461 affects the direct_mail (Direct Mail) extension through version 9.5.1 for TYPO3 . The Configuration backend module allows an authenticated backend user with access to that module to write arbitrary page TSConfig for folders configured as Direct Mail. This leads to Configuration Inj...

CVE-2023-24286

sgt-puzzles (Portable Puzzle Collection) versions before 20230116.5782e29 contain a buffer overflow in the Mosaic puzzle , triggerable via a crafted save file (game description parameter). The vulnerability carries a CVSS 3.1 score of 2.9 (LOW) , with a local attack vector, high complexity, and l...

CVE-2023-50459

CVE-2023-50459 affects the in2code/femanager extension for TYPO3 (versions 7.x before 7.2.3 ). The root cause is broken access control in the edit user component, which fails to verify permissions. An authenticated frontend user can exploit this to edit data or delete accounts of various other fr...

EUVD-2026-76505

In the Linux kernel, the following vulnerability has been resolved: hugetlb: only adjust reservation during unmapping if mapcount is 0 Since df7a6d1f6405, unmaphugepagerange can adjust reservations. In the case of folio mapped in both a parent and a child, if the parent unmaps the range first, th...

EUVD-2026-75184

Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch...

CVE-2026-87999

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-87999 Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/openwebui/retrieval/web/utils.py treated Python's globally routable address classification as proof th...

CVE-2026-87999

Open WebUI (a self-hosted AI platform) had a server-side request forgery (SSRF) vulnerability in backend/open_webui/retrieval/web/utils.py, affecting the POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search endpoints. The root cause was that Python's globally routable ...