CVE-2025-60753 affecting package libarchive for versions less than 3.7.7-4

CVE-2025-60753 affecting package libarchive for versions less than 3.7.7-4. A patched version of the package is available...

CVE-2026-22693 affecting package harfbuzz for versions less than 8.3.0-4

CVE-2026-22693 affecting package harfbuzz for versions less than 8.3.0-4. A patched version of the package is available...

CVE-2026-24809 affecting package memcached for versions less than 1.6.27-4

CVE-2026-24809 affecting package memcached for versions less than 1.6.27-4. A patched version of the package is available...

CVE-2026-25498 Craft has a potential authenticated Remote Code Execution via malicious attached Behavior

Craft is a platform for creating digital experiences. In versions 4.0.0-RC1 through 4.16.17 and 5.0.0-RC1 through 5.8.21, a Remote Code Execution RCE vulnerability exists in Craft CMS where the assembleLayoutFromPost function in src/services/Fields.php fails to sanitize user-supplied configuratio...

CVE-2025-61594 affecting package ruby for versions less than 3.1.7-4

CVE-2025-61594 affecting package ruby for versions less than 3.1.7-4. A patched version of the package is available...

CVE-2025-11961 affecting package nmap for versions less than 7.93-4

CVE-2025-11961 affecting package nmap for versions less than 7.93-4. A patched version of the package is available...

AZL-76874 CVE-2025-58190 affecting package cert-manager 1.12.15-4

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

AZL-76880 CVE-2025-58190 affecting package cf-cli 8.7.11-4

The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

CVE-2026-1707 Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)

pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. An attacker with access to the pgAdmin web interface can observe an active restore operation, extract t...

CVE-2026-25538

creationtimestamp| type| source ---|---|--- 2026-02-04 07:15:37+00:00| published-proof-of-concept| https://github.com/devtron-labs/devtron/security/advisories/GHSA-8wpc-j9q9-j5m2...

CVE-2026-25510

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, an authenticated user with file editor permissions can achieve Remote Code Execution RCE by leveraging the file creation and sav...

EUVD-2026-5163

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.28.5.0, the authentication implementation in CI4MS is vulnerable to email enumeration. An unauthenticated attacker can determine whether...

CVE-2026-25484 Craft Commerce has Stored XSS in Product Type Name

Craft Commerce is an ecommerce platform for Craft CMS. In versions from 4.0.0-RC1 to 4.10.0 and from 5.0.0 to 5.5.1, there is a Stored XSS via Product Type names. The name is not sanitized when displayed in user permissions settings. The vulnerable input source is in Commerce Product Type setting...

CVE-2020-37055

CVE-2020-37055 affects SpyHunter 4 via an unquoted service path in the SpyHunter 4 Service, enabling local privilege escalation by placing malicious executables in specific file-system locations that are loaded during service startup. The vulnerability enables arbitrary code execution with elevat...

EUVD-2020-30969

SpyHunter 4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific file system locations to gain elevated access...

PT-2026-5579

SpyHunter 4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific file system locations to gain elevated access...

[SECURITY] Fedora 42 Update: nodejs24-24.13.0-4.fc42

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices...

AZL-76364 CVE-2025-63658 affecting package fluent-bit 3.1.10-4

A stack overflow in the mkhttpindexlookup function mkserver/mkhttp.c of monkey commit f37e984 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request to the server...

AZL-76533 CVE-2025-63653 affecting package fluent-bit 3.1.10-4

An out-of-bounds read in the mkvhostfdtclose function mkserver/mkvhost.c of monkey commit f37e984 allows attackers to cause a Denial of Service DoS via sending a crafted HTTP request to the server...

CVE-2026-24850

The ML-DSA crate is a Rust implementation of the Module-Lattice-Based Digital Signature Standard ML-DSA. Starting in version 0.0.4 and prior to version 0.1.0-rc.4, the ML-DSA signature verification implementation in the RustCrypto ml-dsa crate incorrectly accepts signatures with repeated duplicat...