PoDoFo 安全漏洞

PoDoFo is a free portable C++ library open-sourced by PoDoFo. A security vulnerability exists in podofo versions v0.10.0 through v0.10.5, which stems from a post-release reuse issue in the PdfTokenizer::ReadDictionary function that could lead to a denial of service attack...

Kazaar 安全漏洞

Kazaar is a print marketing fulfillment platform from Kazaar, Inc. A security vulnerability exists in Kazaar version 1.25.12 that stems from allowing the use of a JWT with an alg field of none, which could lead to authentication bypass...

nopCommerce 安全漏洞

nopCommerce is an open source, general purpose e-commerce platform from nopCommerce, Inc. A security vulnerability exists in nopCommerce version 4.40.3 that stems from improper product name input cleanup and could lead to a cross-site scripting attack...

Kazaar 安全漏洞

Kazaar is a print marketing fulfillment platform from Kazaar, Inc. A security vulnerability exists in Kazaar version 1.25.12 that stems from allowing modification of the order-id parameter, which could lead to an insecure direct object reference attack...

Suricata 安全漏洞

Suricata is a network IDS, IPS and NSM engine from the Open Information Security Foundation. A security vulnerability exists in Suricata version 8.0.0 that stems from the use of the ldap.responses.attributetype keyword and transformations that could lead to a stack buffer overflow...

CVE-2025-10725 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the...

CVE-2025-10725 Openshift-ai: overly permissive clusterrole allows authenticated users to escalate privileges to cluster admin

A flaw was found in Red Hat Openshift AI Service. A low-privileged attacker with access to an authenticated account, for example as a data scientist using a standard Jupyter notebook, can escalate their privileges to a full cluster administrator. This allows for the complete compromise of the...

Hack of US Surveillance Provider RemoteCOM Exposes Court Data

A massive data breach at RemoteCOM exposed 14,000 personal files and police contacts from the SCOUT software. Learn what this aggressive spyware records, and the high risks for all involved parties...

Collegetivity 安全漏洞

Collegetivity is a university student activity system by the individual developer Syauqizaidan Khairan Khalaf. A security vulnerability exists in Collegetivity version 1.0.0, which stems from the presence of an insecure direct object reference in the /dashboard/notes endpoint, which could allow a...

PT-2025-40010

Name of the Vulnerable Software and Affected Versions Karthikg1908 Hospital Management System HMS version 1.0 Description An SQL injection issue exists in the user-login.php and index.php files. The application does not properly sanitize input before using it in SQL queries. This allows remote...

PT-2025-40011

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI versions 2.19 through 2.21 Description A critical flaw exists in Red Hat OpenShift AI Service that allows a low-privileged authenticated user, such as a data scientist using a Jupyter notebook, to escalate their privileges...

CVE-2025-52043

In Frappe ERPNext v15.57.5, the function importcoa at erpnext/accounts/doctype/chartofaccountsimporter/chartofaccountsimporter.py is vulnerable to SQL injection, which allows an attacker to extract all information from databases by injecting a SQL query into the company parameter...

Harrods Data Breach: 430,000 Customer Records Stolen Via Third-Party Attack

Luxury retailer Harrods confirms 430,000 customer records names, contacts were stolen from a third-party provider in the latest UK retail cyberattack wave...

Sex offenders, terrorists, drug dealers, exposed in spyware breach

We've covered spyware and stalkerware leaks many times before, but we don't often see such exposure in software used by law enforcement. According to a report by Straight Arrow News SAN, the hacker “wikkid” said the intrusion against RemoteCOM was “one of the easiest” they’d ever carried out...

MyCourts 安全漏洞

MyCourts is a court management platform from MyCourts UK. A security vulnerability exists in MyCourts v3, which stems from a lack of input validation in the LTA number profile field, which could lead to a stored cross-site scripting attack, and could be exploited to hijack a user session due to t...

Mealie 安全漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A security vulnerability exists in Mealie 3.0.1 and prior versions, which stems from the failure to clean and escape user input in the note and text fields in the recipe creation feature, which coul...

OpenIndiana 安全漏洞

OpenIndiana is an operating system from OpenIndiana Open Source. A security vulnerability exists in OpenIndiana 5.11 that stems from insufficient validation of sequence number ranges in TCP packet processing, which could lead to a denial of service attack...

Medusa Ransomware Claims Comcast Data Breach, Demands $1.2M

Medusa ransomware group claims 834 GB data theft from Comcast, demanding $1.2M ransom while sharing screenshots and file listings...

The vulnerability of the dispc.c component in the Linux operating system’s kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the dispc.c component in the Linux operating system’s kernel is related to memory initialization errors. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the geneve_find_dev() function in the drivers/net/geneve.c component of the Linux kernel allows a hacker to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the genevefinddev function in the drivers/net/geneve.c component of the Linux kernel is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to access confidential data, compromise its integrity, and cause service failures...