Scrapy is vulnerable to a denial of service (DoS) attack due to flaws in brotli decompression implementation

Scrapy versions up to 2.13.3 are vulnerable to a denial of service DoS attack due to a flaw in its brotli decompression implementation. The protection mechanism against decompression bombs fails to mitigate the brotli variant, allowing remote servers to crash clients with less than 80GB of...

EUVD-2024-37055

Malicious code in bioql PyPI...

PT-2025-44569

Name of the Vulnerable Software and Affected Versions Scrapy versions up to 2.13.2 Description Scrapy is susceptible to a denial of service DoS attack stemming from an issue in its brotli decompression implementation. The built-in protection against decompression bombs does not effectively addres...

Security update for freetype2

This update for freetype2 fixes the following issues: Update to 2.13.2: Some fields in the FTOutline structure have been changed from signed to unsigned type, which better reflects the actual usage. It is also an additional means to protect against malformed input. Rare double-free crashes in the...

SUSE-SU-2025:20204-1 Security update for freetype2

This update for freetype2 fixes the following issues: Update to 2.13.2: Some fields in the FTOutline structure have been changed from signed to unsigned type, which better reflects the actual usage. It is also an additional means to protect against malformed input. Rare double-free crashes in the...

CVE-2024-37242 WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic Newspack Newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through 2.13.2...

CVE-2024-37242 WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Cross Site Request Forgery.This issue affects Newspack Newsletters: from n/a through = 2.13.2...

WordPress plugin Newspack Newsletters 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site request forge...

WordPress plugin Newspack Newsletters 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Newspack Newsletters plugin <= 2.13.2 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin Newspack Newsletters versions = 2.13.2...

Nuki Bridge 安全漏洞

Nuki Bridge is a smart lock control software from Nuki. A security vulnerability exists in Nuki Bridge v1.x prior to v1.22.0 and v2.x prior to v2.13.2, and Nuki Keypad v1.9.2 prior to v1.9.2, which stems from the fact that sending multiple incorrectly-formatted packets can prevent certain functio...

Nuki Bridge 安全漏洞

Nuki Bridge is a smart lock control software from Nuki. A security vulnerability exists in Nuki Bridge v1.x prior to v1.22.0 and v2.x prior to v2.13.2, and Nuki Keypad v1.9.2 prior to v1.9.2, which stems from the fact that sending an incorrectly formatted HTTP verb can force a device to reboot...

Nuki Bridge 安全漏洞

Nuki Bridge is a smart lock control software from Nuki. A security vulnerability exists in v1.x versions prior to Nuki Bridge v1.22.0 and v2.x versions prior to v2.13.2, and Nuki Keypad v1.9.2 prior to v1.9.2, which stems from the fact that an attacker may be able to connect to the device and...

PT-2024-11566 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions prior to 1.22.0 Nuki Bridge versions prior to 2.13.2 Description: A buffer overflow issue was discovered in the HTTP service of certain Nuki Home Solutions devices, specifically in the encrypted token parsing logic. This...

PT-2024-11574 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions 1.0.0 through 1.21.0 Nuki Bridge versions 2.0.0 through 2.13.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where the HTTP API exposed by a Bridge used an unencrypted channel to provide an...

PT-2024-11572 · Nuki Home Solutions · Nuki Bridge

Name of the Vulnerable Software and Affected Versions: Nuki Bridge versions prior to 1.22.0 Nuki Bridge versions prior to 2.13.2 Description: An issue was discovered on certain Nuki Home Solutions devices, where sending a malformed HTTP verb can force a reboot of the device. Recommendations: For...

Blosc C-Blosc2 安全漏洞

Blosc C-Blosc2 is a code library from the Blosc team that allows deep compression of binary data. The goal of the software is to reduce the size of large datasets on disk or in memory, to speed up memory-bound computations, and the software supports BloscLZ, a compression program based on FastLZ,...

PT-2024-24372 · C-Blosc2 · C-Blosc2

Name of the Vulnerable Software and Affected Versions: c-blosc2 versions up to 2.13.2 Description: A critical issue has been found, affecting the ndlz4 decompress function in the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. This issue leads to a heap-based buffer overflow. The attack can be...

Blosc C-Blosc2 安全漏洞

Blosc C-Blosc2 is a code library from the Blosc team that allows deep compression of binary data. The goal of the software is to reduce the size of large datasets on disk or in memory, to speed up memory-bound computations, and the software supports BloscLZ, a compression program based on FastLZ,...

SQL Injection in liftkit/database

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The name of the patch is...