CVE-2025-27134 Privilege escalation in Joplin server via user patch endpoint

Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id t...

CVE-2025-27134

CVE-2025-27134 concerns Joplin server prior to version 3.3.3, where a vulnerability in the PATCH /api/users/:id endpoint allows a non-admin user to set the is_admin field to 1. This privilege escalation enables low-privilege users to perform administrative actions without proper authorization. Th...

PT-2025-18288 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.3.3 Description: A privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint PATCH /api/users/:id to set the is admin field to 1. This issue allows maliciou...

GHSA-FX44-2WX5-5FVP Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required...

CVE-2025-3910

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

PT-2025-18208

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw was found in Keycloak, specifically in the org.keycloak.authorization package, which may be vulnerable to circumventing required actions. This allows users to bypass requirements such...

Zimbra 安全漏洞

Zimbra is an open source email collaboration platform from Zimbra, Inc. A security vulnerability exists in Zimbra versions 9.0 through 10.1, which stems from a lack of CSRF token validation on GraphQL endpoints, which could lead to unauthorized operations...

CVE-2025-43854

DIFY (LangGenius Open Source) prior to version 1.3.0 is affected by a clickjacking vulnerability in the default web setup. The issue allows an attacker to trick users into clicking on elements, potentially triggering unauthorized actions and compromising security/privacy. The vulnerability is fix...

CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

CVE-2025-43854 DIFY vulnerable to Clickjacking Attack

DIFY is an open-source LLM app development platform. Prior to version 1.3.0, a clickjacking vulnerability was found in the default setup of the DIFY application, allowing malicious actors to trick users into clicking on elements of the web page without their knowledge or consent. This can lead to...

PT-2025-18091 · Onevision · Onevision Workspace

Name of the Vulnerable Software and Affected Versions: OneVision Workspace versions prior to WS23.1 SR1 build w31.040 Description: The issue allows for arbitrary Java EL execution. This means that an attacker could potentially execute malicious Java Expression Language code, leading to unauthoriz...

SUSE CVE-2025-35965

Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific post...

CVE-2024-57375

Andamiro Pump It Up 20th Anniversary aka Double X or XX/2019 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service application crash via certain deselect actions...

CVE-2025-35965

Mattermost versions 10.4.x = 10.4.2, 10.5.x = 10.5.0, 9.11.x = 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operation, which allows an attacker to create task items containing an excessive number of actions triggered by specific post...

CVE-2025-29722

A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missing CSRF protection on sensitive endpoints...

CVE-2025-2105

The Jupiter X Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.8.11 via deserialization of untrusted input from the 'file' parameter of the 'ravendownloadfile' function. This makes it possible for attackers to inject a PHP Object through a PH...

CVE-2025-3861

CVE-2025-3861 affects the WordPress plugin Prevent Direct Access – Protect WordPress Files (versions 2.8.6–2.8.8.2). A misconfigured capability check in pda_lite_custom_permission_check allows authenticated users with Contributor+ privileges to access and modify the protection status of media. At...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the validateUpdateTaskActions function used by the UpdateRunTaskActions GraphQL operation. Due to the lack of limitation on task action uniqueness and quantity, a user can cause an...