CVE-2025-13353

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

EUVD-2025-201311

Kalmia CMS version 0.2.0 contains a user enumeration vulnerability in its authentication mechanism. The application returns different error messages for invalid users usernotfound versus valid users with incorrect passwords invalidpassword. This observable response discrepancy allows...

EUVD-2025-201310

Kalmia CMS version 0.2.0 contains an Incorrect Access Control vulnerability in the /kal-api/auth/users API endpoint. Due to insufficient permission validation and excessive data exposure in the backend, an authenticated user with basic read permissions can retrieve sensitive information for all...

Kalmia 安全漏洞

Kalmia is an open source document content management system from Iridia Solutions Private Limited. A security vulnerability exists in Kalmia version 0.2.0, which stems from the authentication mechanism returning a different error message that could lead to user enumeration...

PT-2025-49145

Name of the Vulnerable Software and Affected Versions Kalmia CMS version 0.2.0 Description Kalmia CMS version 0.2.0 has an issue with access control in the /kal-api/auth/users API endpoint. Insufficient permission validation and excessive data exposure in the backend allow an authenticated user...

CVE-2025-65899

Kalmia CMS v0.2.0 is affected by an authentication flaw described as an Observable Response Discrepancy. The login endpoint /kal-api/auth/jwt/create reveals existence of accounts by returning distinct messages: user_not_found for invalid usernames and invalid_password for valid usernames with a w...

Linux Distros Unpatched Vulnerability : CVE-2025-13353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM...

CVE-2025-13353 gokey allows secret recovery from a seed file without the master password

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

CVE-2025-13353 gokey allows secret recovery from a seed file without the master password

In gokey versions 0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any...

CVE-2025-13353

The CVE-2025-13353 issue affects gokey versions prior to 0.2.0, where a flaw in the seed decryption logic caused passwords/secrets derived from a seed file to be generated from only 28 bytes of entropy (instead of using the full seed, 240 bytes). This allowed a malicious actor with just the seed ...

SQL Injection

Overview sonnixgres is an A production-ready Python library for PostgreSQL database interactions with connection pooling, query caching, and rich console output. Affected versions of this package are vulnerable to SQL Injection due to inadequate sanitization of SQL identifiers in...

Incorrect Authorization

Overview agent-mcp-gateway is an An MCP gateway that aggregates your existing MCP servers and lets you define which servers and individual tools each agent or subagent can access. Solves Claude Code's MCP context window waste where all tool definitions load upfront instead of being discovered whe...

PT-2025-48664

Name of the Vulnerable Software and Affected Versions gokey versions prior to 0.2.0 Description A flaw in the seed decryption logic caused passwords to be incorrectly derived using only a portion of the expected entropy when generating keys/secrets from a seed file. This resulted in potentially...

PT-2025-46957

Name of the Vulnerable Software and Affected Versions ury-erp ury versions up to 0.2.0 Description A weakness exists in ury-erp ury that allows for SQL injection. This issue is related to the manipulation of the search term argument within the overrided past order list function located in the fil...

CVE-2025-64501

Summary: CVE-2025-64501 affects the ProsemirrorToHtml gem used to convert ProseMirror JSON to HTML. In versions 0.2.0 and earlier, it is vulnerable to Cross-Site Scripting (XSS) through malicious HTML attribute values because attribute values aren’t escaped, while tag content is. Impact applies t...

CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...

CVE-2025-64501 ProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...

EUVD-2025-50824

ProsemirrorToHtml is a JSON converter which takes ProseMirror-compatible JSON and outputs HTML. In versions 0.2.0 and below, the prosemirrortohtml gem is vulnerable to Cross-Site Scripting XSS attacks through malicious HTML attribute values. While tag content is properly escaped, attribute values...

PT-2025-46205

Name of the Vulnerable Software and Affected Versions ProsemirrorToHtml versions 0.2.0 and below Description The prosemirror to html gem contains a flaw that allows for Cross-Site Scripting XSS attacks. This is due to improper handling of HTML attribute values during the conversion of...

ProsemirrorToHtml 跨站脚本漏洞

ProsemirrorToHtml is an open source HTML code conversion tool from Etamin Studio. A cross-site scripting vulnerability exists in ProsemirrorToHtml 0.2.0 and earlier versions, which stems from not properly escaping HTML attribute values and could lead to cross-site scripting attacks...