CVE-2019-25310 ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path

ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated...

CVE-2025-59386

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-66274 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-66277

CVE-2025-66277 is a high-severity, network-exploitable vulnerability in several QNAP OS platforms where a crafted link can enable filesystem traversal to unintended locations. The CVE lists a root cause related to path traversal within a link-following component and indicates a modified impact on...

CVE-2025-66277 QTS, QuTS hero

A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3350 build...

[SECURITY] Fedora 42 Update: rust-shadow-rs-0.8.1-14.fc42

A build-time information stored in your rust project...

[SECURITY] Fedora 42 Update: rust-eif_build-0.2.1-6.fc42

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

SUSE CVE-2026-25765

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's buildexclusiveurl method in lib/faraday/connection.rb uses Ruby's URImerge to combine the connection's base URL with a user-supplied path. Per RFC 3986,...

ActFax ActiveFax Server code-related vulnerabilities

ActFax ActiveFax Server is a fax server software developed by the Austrian company ActFax. Version 6.92 Build 0316 of ActFax ActiveFax Server has a code vulnerability. This vulnerability stems from an unquoted service path within the ActiveFaxServiceNT service, which may allow local attackers to...

TorrentRockYou Torrent FLV Converter has a security vulnerability

TorrentRockYou Torrent FLV Converter is a video format conversion tool developed by TorrentRockYou Inc. Version 1.51 Build 117 of TorrentRockYou Torrent FLV Converter has a security vulnerability. This vulnerability stems from a stack buffer overflow, which may allow for the execution of arbitrar...

com.flowlogix:build-core (>=0.8.6, <=0.9-obsolete), com.flowlogix:flowlogix-services (>=0.8.6, <=0.9-obsolete) +55 more potentially affected by CVE-2026-23901 via org.apache.shiro:shiro-core (1.1.0)

org.apache.shiro:shiro-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - com.flowlogix:build-core =0.8.6, =0.8.6, =0.9, =0.8.9, =0.8.9, =1.0, =1.4.8, =1.4.10 -...

br.com.caelum.vraptor:vraptor-shiro (>=4.0.0-beta-1, <=4.0.0-rc2), com.flowlogix:flowlogix-tapestry (>=1.2.3, <=1.2.10) +210 more potentially affected by CVE-2026-23901 via org.apache.shiro:shiro-core (1.2.2)

org.apache.shiro:shiro-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.shiro:shiro-core and may be impacted: - br.com.caelum.vraptor:vraptor-shiro =4.0.0-beta-1, =1.2.3, =1.2.3, =1.0.0.release, =2.1.3, =2.1.3, =1.0,...

Security Bulletin: IBM OpenPages is affected by multiple security vulnerabilities of DB2 Database Server (January 2026)

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about security vulnerabilities affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2026-25765

A flaw was found in Faraday, an HTTP client library. The buildexclusiveurl method, which combines a base URL with a user-supplied path, incorrectly processes protocol-relative URLs e.g., //evil.com/path. This allows a remote attacker to supply a specially crafted URL, leading to Server-Side Reque...

[SECURITY] Fedora 43 Update: rust-shadow-rs-0.8.1-14.fc43

A build-time information stored in your rust project...

[SECURITY] Fedora 43 Update: rust-eif_build-0.2.1-6.fc43

This CLI tool provides a low level path to assemble an enclave image format EIF file used in AWS Nitro Enclaves...

[SECURITY] Fedora 43 Update: cef-144.0.11^chromium144.0.7559.109-2.fc43

CEF is an embeddable build of Chromium, powered by WebKit Blink...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the buildexclusiveurl function in the connection.rb‎ file. An attacker can cause requests to be sent to arbitrary hosts by supplying a protocol-relative URL as input. Workaround This vulnerability ca...

AZL-77639 CVE-2026-25765 affecting package rubygem-faraday 2.5.2-1

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's buildexclusiveurl method in lib/faraday/connection.rb uses Ruby's URImerge to combine the connection's base URL with a user-supplied path. Per RFC 3986,...

AZL-77631 CVE-2026-25765 affecting package rubygem-faraday for versions less than 2.7.10-2

Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Prior to 2.14.1, Faraday's buildexclusiveurl method in lib/faraday/connection.rb uses Ruby's URImerge to combine the connection's base URL with a user-supplied path. Per RFC 3986,...