EUVD-2025-36366

Landlord Onboarding & Rental Signup introduces the landlord onboarding workflow and rental signup system for VivaTurbo Rentals & Property Services. In 2.0.0 and earlier, a vulnerability was identified in the TurboTenant property listing activation workflow that could allow unauthorized access to...

squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling

A Information Disclosure vulnerability has been identified in the Squid web caching proxy. This flaw occurs when the application fails to properly redact sensitive Hypertext Transfer Protocol HTTP authentication credentials from an error response. A remote client can exploit this by triggering an...

CVE-2025-12343

A flaw was found in FFmpeg’s TensorFlow backend within the libavfilter/dnnbackendtf.c source file. The issue occurs in the dnnexecutemodeltf function, where a task object is freed multiple times in certain error-handling paths. This redundant memory deallocation can lead to a double-free conditio...

Malicious Package

Overview orderbook-backend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Siemens SIMATIC Devices NULL Pointer Dereference (CVE-2024-50153)

In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix null-ptr-deref in targetallocdevice There is a null-ptr-deref issue reported by KASAN: BUG: KASAN: null-ptr-deref in targetallocdevice+0xbc4/0xbe0 targetcoremod ... kasanreport+0xb9/0xf0...

FFmpeg 安全漏洞

FFmpeg is a complete solution for recording, converting, and streaming audio and video from the FFmpeg team. A security vulnerability exists in FFmpeg, which originates from the dnnexecutemodeltf function in the libavfilter/dnnbackendtf.c source file that releases a task object multiple times in...

MAL-2025-48602 Malicious code in orderbook-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7b538ac9c8ab390683e5923fed557542d1a2cbeda2aee3ed14627473bd4779 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in orderbook-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7b538ac9c8ab390683e5923fed557542d1a2cbeda2aee3ed14627473bd4779 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-35940

Malicious code in orderbook-backend npm...

CVE-2025-8416

The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

cybersec-ids

cybersec-ids Full-stack AI-driven Web App Intrusion Detection...

CVE-2025-62714

Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints e.g., /api/v1/secret, /api/v1/service did not...

EUVD-2025-35920

The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2025-8416 Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection

The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2025-8416

CVE-2025-8416 affects the WordPress Plugin Product Filter by WBW. All versions up to 2.9.7 are vulnerable to unauthenticated SQL injection via the filtersDataBackend parameter due to insufficient input escaping and inadequate SQL query preparation. The issue allows attackers to append additional ...

CVE-2025-8416 Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection

The Product Filter by WBW plugin for WordPress is vulnerable to SQL Injection via the 'filtersDataBackend' parameter in all versions up to, and including, 2.9.7. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

Karmada Dashboard 安全漏洞

Karmada Dashboard is a web user interface from karmada-io open source. A security vulnerability exists in versions of Karmada Dashboard prior to 0.2.0 that stems from a back-end API endpoint that does not enforce authentication, which could lead to unauthenticated users accessing sensitive cluste...

EUVD-2025-35859

Karmada Dashboard is a general-purpose, web-based control panel for Karmada which is a multi-cluster management project. Prior to version 0.2.0, there is an authentication bypass vulnerability in the Karmada Dashboard API. The backend API endpoints e.g., /api/v1/secret, /api/v1/service did not...

EulerOS 2.0 SP13 : protobuf (EulerOS-SA-2025-2275)

According to the versions of the protobuf packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups,...

CVE-2025-11915

Connection desynchronization between an HTTP proxy and the model backend. The fixes were rolled out for all proxies in front of impacted models by 2025-09-28. Users do not need to take any action...