2117 matches found
EUVD-2025-30408
Malicious code in bioql PyPI...
EUVD-2025-24819
Malicious code in bioql PyPI...
Claude Code 安全漏洞
Claude Code is an open source proxy coding tool from Anthropic. A security vulnerability exists in Claude Code versions prior to 1.0.120 that stems from a failure to consider symbolic links when checking permission denial rules, which could lead to bypassing file access restrictions...
CVE-2025-54315
The CVE-2025-54315 issue affects the Matrix protocol: prior to matrix 1.16 (room version
CVE-2025-38625 affecting package kernel for versions less than 6.6.104.2-1
CVE-2025-38625 affecting package kernel for versions less than 6.6.104.2-1. An upgraded version of the package is available that resolves this issue...
PT-2025-40253
Name of the Vulnerable Software and Affected Versions IMPAQTR Aurora versions prior to 1.36 Description The software contains an Insecure Direct Object Reference issue. This allows unauthorized access to the users list, organization details, bookmarks, and notifications of an arbitrary...
CVE-2025-11152
Sandbox escape due to integer overflow in the Graphics: Canvas2D component. This vulnerability affects Firefox 143.0.3...
CVE-2025-41095 Insecure Direct Object Reference in GPS BOLD Workplanner
Insecure Direct Object Reference IDOR vulnerability in BOLD Workplanner in versions prior to 2.5.25 4935b438f9b, consisting of a lack of adequate validation of user input, allowing an authenticated user to access to planning counter details using unauthorised internal identifiers...
NewStart CGSL MAIN 6.06 : gcc Vulnerability (NS-SA-2025-0227)
The remote NewStart CGSL host, running version MAIN 6.06, has gcc packages installed that are affected by a vulnerability: - The POWER9 backend in GNU Compiler Collection GCC before version 10 could optimize multiple calls of the builtindarn intrinsic into a single call, thus reducing the entropy...
GHSA-FMJH-F678-CV3X github.com/nyaruka/phonenumbers Vulnerable to Improper Validation of Syntactic Correctness of Input
Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range"...
CVE-2025-11025
Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data. This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0...
CVE-2025-10449
CVE-2025-10449 affects Saysis Web Portal versions 3.1.9 and 3.2.0 prior to 3.2.1. Root cause is improper limitation of a pathname to a restricted directory, enabling path traversal. Evidence from multiple sources (CVE entries and PT-2025-39365) confirms the issue and lists 3.2.1 as the fixed vers...
CVE-2025-10438
Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7...
CVE-2025-10502
Heap buffer overflow in ANGLE in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. Chromium security severity: High...
CVE-2025-57354
A vulnerability exists in the 'counterpart' library for Node.js and the browser due to insufficient sanitization of user-controlled input in translation key processing. The affected versions prior to 0.18.6 allow attackers to manipulate the library's translation functionality by supplying...
CVE-2025-9588
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection.This issue affects enVision: before 250563...
CVE-2025-9588
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Iron Mountain Archiving Services Inc. EnVision allows Command Injection. This issue affects enVision: before 250563...
CVE-2025-9035
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...
CVE-2025-9035 Reflected XSS in Horato Internet Technologies' Virtual Library Platform
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Horato Internet Technologies Ind. And Trade Inc. Virtual Library Platform allows Reflected XSS. This issue affects Virtual Library Platform: before v202...
