CVE-2025-15128

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safesetting/ of the component Endpoint. Performing a manipulation of the argument backupencryptionpassworddecrypt/exportencryptionpassworddecrypt results in unprotected storage o...

PT-2025-53599

Name of the Vulnerable Software and Affected Versions Cola Dnslog version 1.3.2 Description The application processes DNS queries for TXT records by concatenating the requested URL with a base path using os.path.join. This allows for directory traversal or absolute path injection. Successful...

CVE-2025-57403

Cola Dnslog v1.3.2 is vulnerable to Directory Traversal. When a DNS query for a TXT record is processed, the application concatenates the requested URL or a portion of it directly with a base path using os.path.join. This bypass allows directory traversal or absolute path injection, leading to th...

CVE-2023-54016

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This memory leak vulnerability occurs because the driver allocates memory for receive and transmit descriptors during initialization but fails to free this memory during cleanup. A local attacker could exploit this by repeatedly triggeri...

Permissive List of Allowed Inputs

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Permissive List of Allowed Inputs in the Webhook Node's IP whitelist validation due to includes method performing partial string matching instead of exact IP comparison. An attacker can gain...

When the Base Station Flies: Rethinking Security for UAV-Based 6G Networks

The integration of non-terrestrial networks NTNs into 6G systems is crucial for achieving seamless global coverage, particularly in underserved and disaster-prone regions. Among NTN platforms, unmanned aerial vehicles UAVs are especially promising due to their rapid deployability. However, this...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the path parameter when an absolute URL is provided, causing the baseuri to be ignored. An attacker can cause sensitive credentials such as API keys to be sent to unintended third-party hosts or forc...

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

GHSA-HM5P-X4RQ-38W4 httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

httparty Has Potential SSRF Vulnerability That Leads to API Key Leakage

Summary There may be an SSRF vulnerability in httparty. This issue can pose a risk of leaking API keys, and it can also allow third parties to issue requests to internal servers. Details When httparty receives a path argument that is an absolute URL, it ignores the baseuri field. As a result, if ...

ROS-20251223-7303

Vulnerability in 389-ds-base related to null pointer dereferencing. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

📄 PKP-WAL 3.5.0-1 baseColour LESS Code Injection

PKP-WAL versions 3.5.0-1 and below suffer from a LESS baseColour related code injection vulnerability. ----------------------------------------------------------------- PKP-WAL = 3.5.0-1 baseColour LESS Code Injection Vulnerability -----------------------------------------------------------------...

WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin BWL Knowledge Base Manager versions = 1.6.3...

CVE-2025-66905

The Takes web framework's TkFiles take thru 2.0-SNAPSHOT fails to canonicalize HTTP request paths before resolving them against the filesystem. A remote attacker can include ../ sequences in the request path to escape the configured base directory and read arbitrary files from the host system...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the API Request component, which accepts user-supplied URLs and issues HTTP requests from the server without adequate filtering of internal or private network addresses. An attacker can access intern...

CVE-2025-66910

Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...

MAL-2025-192630 Malicious code in foundations-theming-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58f9a087aa35c09a66eecf85d207eecd0a562d059891388be07c1b47f566db6 The package foundations-theming-base was found to contain malicious code. Source: ghsa-malware...

Malicious code in foundations-theming-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d58f9a087aa35c09a66eecf85d207eecd0a562d059891388be07c1b47f566db6 The package foundations-theming-base was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-204506

Malicious code in foundations-theming-base npm...

Malicious Package

Overview foundations-theming-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...