CVE-2025-62721

LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, authenticated RSS feed endpoints in the FeedController class fail to implement proper authorization checks, allowing any authenticated user to access all links, lists, and tags from all users in the system,...

CVE-2025-62720

CVE-2025-62720 affects the LinkAce self-hosted archive. The vulnerability lies in the ExportController HTML/CSV export paths, which retrieve all links without applying ownership or visibility filtering, enabling any authenticated user to exfiltrate private links from all users. Affected versions ...

📄 Windows Persistent Startup Folder

This Metasploit module establishes persistence by creating a payload in the user or system startup folder. Works on Vista and newer systems. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule...

CVE-2025-12103

A flaw was found in Red Hat Openshift AI Service. The TrustyAI component is granting all service accounts and users on a cluster permissions to get, list, watch any pod in any namespace on the cluster. TrustyAI is creating a role trustyai-service-operator-lmeval-user-role and a CRB...

CVE-2025-11406 kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

EUVD-2025-32889

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

CVE-2025-11406 kaifangqian kaifangqian-base SysUserController.java getAllUsers information disclosure

A security flaw has been discovered in kaifangqian kaifangqian-base up to 7b3faecda13848b3ced6c17c7423b76c5b47b8ab. This issue affects the function getAllUsers of the file kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java. The...

CVE-2025-11406

CVE-2025-11406 affects kaifangqian-base; the flaw is in SysUserController.getAllUsers (kaifangqian-parent/kaifangqian-system/src/main/java/com/kaifangqian/modules/system/controller/SysUserController.java). It enables information disclosure via remote manipulation; exploits have been released publ...

EUVD-2000-0297

Malware in sbrugna...

EUVD-2022-0927

Malicious code in bioql PyPI...

EUVD-2022-3896

Malicious code in bioql PyPI...

EUVD-2024-3532

Malicious code in bioql PyPI...

BIT-GITLAB-2025-7337 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed an authenticated user with Developer-level access to cause a persistent denial of service affecting all users on a GitLab instance by...

PT-2025-35776

Name of the Vulnerable Software and Affected Versions: Slink version 1.4.9 Description: Slink version 1.4.9 allows stored cross-site scripting XSS through crafted SVG uploads. When a user views the shared image in a new browser tab, the embedded JavaScript executes. This issue affects both...

CVE-2025-58156 Centurion ERP users can view hashed authentication tokens that belong to other users

Centurion ERP is an ERP with a focus on ITSM and automation. In versions starting from 1.12.0 to before 1.21.0, an authenticated user can view all authentication token details within the database. This includes the actual token, although only the hashed token. This does not include any un-hashed...

Linux Distros Unpatched Vulnerability : CVE-2025-3580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An access control vulnerability was discovered in Grafana OSS where an Organization administrator could permanently delete the Server administrator account. Thi...

Discourse 访问控制错误漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes features such as communities, email, and chat rooms. An access control error vulnerability exists in Discourse versions prior to 3.4.3 and prior to 3.5.0.beta3, which stems from bypassing...

Printers intermittently shows Access denied, Unable to connect

Customer has moved from 7.15 to DAAS with WEM on cloud, Since then they are facing issues with printers intermittently 2. Issue is occurring with all the users Admins and non Admins 3. Issue got auto resolved post 15-20 minutes and sometimes users need to close the application and they able to...

CVE-2025-27583

Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows create and modify user accounts, including an Administrator account...

CVE-2024-13067 CodeAstro Online Food Ordering System All Users Page all_users.php access control

A vulnerability was found in CodeAstro Online Food Ordering System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/allusers.php of the component All Users Page. The manipulation leads to improper access controls. The attack may be initiated remotely...