LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex versions 0.12.27 to 0.12.40, which stems from insecure deserialization of the JsonPickleSerializer component and could lead to remote code execution...

BoyunCMS 安全漏洞

BoyunCMS is an enterprise content management system from Boyun China. A security vulnerability exists in BoyunCMS 1.21 and earlier versions, which stems from a misuse of the parameter dbhost leading to deserialization...

MAL-2025-5720 Malicious code in protobufjs-protify-example (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a1fc26bdc2549188a81eca766317ffb5fdf7c0f904db9df458c43a670a86951 Any computer that has this package installed or running should be considered...

MAL-2025-5616 Malicious code in with-next-intl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d19de7a1f0382187b4331c426d9c88dddd8734112cac8bfd611c4edadf922ad Any computer that has this package installed or running should be considered...

CVE-2025-6814 Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function

The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportnow function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal...

The vulnerability of the drm/xe component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the drm/xe component in the Linux operating system is related to the breach of the initial buffer boundary. Exploiting this vulnerability could allow an attacker to trigger a service failure...

MediaWiki Security Breach

MediaWiki is a set of free and freely available web-based Wiki engines from the American Wikimedia Wikimedia Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki has a security vulnerability that stems from vulnerability to HTML...

MediaWiki Security Breach

MediaWiki is a set of free and freely available web-based Wiki engines from the American Wikimedia Wikimedia Foundation. The product can be used to deploy internal knowledge management and content management systems. MediaWiki has a security vulnerability that stems from IP leakage to...

PT-2025-27939 · Designthemes · Red Art

Name of the Vulnerable Software and Affected Versions: designthemes Red Art versions 3.7 and earlier Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can be exploited due to the deserialization of untrusted data, potentially leading to...

The vulnerability of the FreeScout support service management system lies in the lack of measures to protect the website structure. This allows attackers to disclose confidential information and gain control over user sessions.

The vulnerability of the FreeScout support service management system lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to disclose confidential information and gain control over user sessions...

Threat Exposure as a Narrative: If Attackers Tell a Story, Why Don’t We?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Security teams are losing the communication battle to cybercriminals who intuitively understand...

Threat Exposure as a Narrative: If Attackers Tell a Story, Why Don’t We?

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Security teams are losing the communication battle to cybercriminals who intuitively understand...

MAL-2025-5722 Malicious code in react-fixtures-ssr (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d710afc7119dec419c22aa6e052c351680e8510317df2c1ea02c3ab56eec3bf4 Any computer that has this package installed or running should be considered...

CVE-2025-27460

The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker ca...

CVE-2025-1708

The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content...

CVE-2025-1708 CVE-2025-1708

The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content...

Henan Xiaopi PHPStudy 安全漏洞

Henan Xiaopi PHPStudy is a program integration package for PHP debugging environment from Henan Xiaopi Henan Xiaopi, a Chinese company. A security vulnerability exists in Henan Xiaopi PHPStudy versions 2016 through 2018 that stems from a backdoor that allows an unauthenticated remote attacker to...

CVE-2025-34091

CVE-2025-34091 describes a padding oracle vulnerability in Google Chrome’s AppBound cookie encryption, due to DPAPI decryption error reporting in Windows Event Logs. A local attacker can send malformed SYSTEM-DPAPI ciphertext to Chrome’s elevation service, distinguish padding vs MAC errors, and p...

Qantas Confirms Major Data Breach Linked to Third-Party Vendor

Qantas has confirmed a data breach after attackers gained access through a third-party call centre platform, affecting millions…...

CVE-2025-27025

creationtimestamp| type| source ---|---|--- 2025-07-02 12:47:33+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114783712216991743 2025-07-02 13:04:56+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsybo6icpv2r...