CVE-2026-6985

CVE-2026-6985 affects Cesanta Mongoose up to 7.20, specifically the TCP Option Handler’s handle_opt in /src/net_builtin.c. The vulnerability arises from manipulating the argument optlen, which can cause an infinite loop. It is described as remotely exploitable, and an exploit has been made public...

CVE-2025-6985 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-6985 vulnerabilities

Vulnerabilities for packages: py3-langchain-text-splitters, open-webui...

CVE-2025-6985

No description is available for this CVE. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability...

CVE-2025-6985

The CVE-2025-6985 entry concerns LangChain Text Splitters (langchain-text-splitters) v0.3.8, with an XML External Entity (XXE) risk due to unsafe XSLT parsing. The connected docs explain that arbitrary XSLT stylesheets are parsed using lxml.etree.parse() and lxml.etree.XSLT() without hardening, a...

PT-2025-29689

Name of the Vulnerable Software and Affected Versions langchain-text-splitters version 0.3.8 Description The HTMLSectionSplitter class is susceptible to XML External Entity XXE attacks because of unsafe XSLT parsing. The class permits the use of arbitrary XSLT stylesheets, which are parsed using...

CVE-2024-6985

A path traversal vulnerability exists in the api openpersonalityfolder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personalityfolder on the victim's computer, even though sanitizepath is set. The issue arises due to improper sanitization of t...

CVE-2023-6985

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with...

CVE-2024-6985

creationtimestamp| type| source ---|---|--- 2024-10-11 18:42:38+00:00| seen| https://t.me/cvedetector/7696...

CVE-2024-6985 Path Traversal in api open_personality_folder in parisneo/lollms-webui

A path traversal vulnerability exists in the api openpersonalityfolder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personalityfolder on the victim's computer, even though sanitizepath is set. The issue arises due to improper sanitization of t...

CVE-2024-6985 Path Traversal in api open_personality_folder in parisneo/lollms-webui

A path traversal vulnerability exists in the api openpersonalityfolder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personalityfolder on the victim's computer, even though sanitizepath is set. The issue arises due to improper sanitization of t...

Ubuntu 14.04 LTS : ImageMagick vulnerabilities (USN-6985-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6985-1 advisory. It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into...

CVE-2023-6985

creationtimestamp| type| source ---|---|--- 2024-02-19 08:26:51+00:00| seen| https://t.me/ctinow/187504...

CVE-2023-6985

The 10Web AI Assistant – AI content writing assistant plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the installplugin AJAX action in all versions up to, and including, 1.0.18. This makes it possible for authenticated attackers, with...

WordPress 10Web AI Assistant Plugin <= 1.0.18 is vulnerable to Broken Access Control

Software 10Web AI Assistant Type Plugin Vulnerable versions = 1.0.18 Fixed in 1.0.19 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-6985 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 64e97c95dab3 Credits Krzysztof Zając...

部分MediaTek芯片 安全漏洞

MediaTek chips are a variety of chips from MediaTek, a Chinese company MediaTek. A security vulnerability exists in some MediaTek chips, which stems from a local privilege escalation due to a lack of privilege checking in vow. The following products are affected: MT6580, MT6735, MT6737, MT6739,...

RHEL 8 : nodejs:14 (RHSA-2022:6985)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:6985 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

CVE-2020-6985

CVE-2020-6985 affects Moxa PT-7528 and PT-7828 Ethernet switches: firmware versions PT-7528 ≤ 4.0 and PT-7828 ≤ 3.9 expose a hard-coded service code for console access. The Red Hat and NVD entries, plus the ICS advisory, confirm a remote-exploitation risk with high-impact vectors (remote, no user...

CVE-2019-7213

SmarterTools SmarterMail 16.x before build 6985 allows directory traversal. An authenticated user could delete arbitrary files or could create files in new folders in arbitrary locations on the mail server. This could lead to command execution on the server for instance by putting files inside th...

CVE-2019-7214

SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server when port 17001 was remotely accessible. This port is not accessible remotely by default after applying the Build 6985 patch...