18459 matches found
CVE-2025-10546
This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface CGI parameters at its web management portal. A remote attacker could exploit this vulnerability by injecting malicious JavaScript into the vulnerable parameter, leading to a reflected...
CVE-2022-50336
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add null pointer check to attrloadrunsvcn Some metadata files are handled before MFT. This adds a null pointer check for some corner cases that could lead to NPD while reading these metadata files for a malformed NTFS...
CVE-2023-53291
creationtimestamp| type| source ---|---|--- 2025-09-16 09:06:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lywxrbbov72j...
Openfire has potential identity spoofing issue via unsafe CN parsing
Summary Identity spoofing in X.509 client certificate authentication in Openfire allows internal attackers to impersonate other users via crafted certificate subject attributes, due to regex-based extraction of CN from an unescaped, provider-dependent DN string. Analysis Openfire’s SASL EXTERNAL...
GHSA-W252-645G-87MP Openfire has potential identity spoofing issue via unsafe CN parsing
Summary Identity spoofing in X.509 client certificate authentication in Openfire allows internal attackers to impersonate other users via crafted certificate subject attributes, due to regex-based extraction of CN from an unescaped, provider-dependent DN string. Analysis Openfire’s SASL EXTERNAL...
PPC 2K15X Router Cross-site Scripting Vulnerability
The PPC 2K15X Router is a home gateway device from PPC USA. A cross-site scripting vulnerability exists in the PPC 2K15X Router that stems from improper validation of inputs to CGI parameters in the Web Management Portal, which could lead to a reflective cross-site scripting attack...
A Systematic Evaluation of Parameter-Efficient Fine-Tuning Methods for the Security of Code LLMs
Code-generating Large Language Models LLMs significantly accelerate software development. However, their frequent generation of insecure code presents serious risks. We present a comprehensive evaluation of seven parameter-efficient fine-tuning PEFT techniques, demonstrating substantial gains in...
Important: podman security update
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Podman kube play command may overwrite host files CVE-2025-9566 For more details...
CVE-2025-45091
Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting XSS attack. An authenticated attacker can exploit this vulnerability by modifying their username to include a malicious XSS payload in notification and activities...
CVE-2025-59154 Openfire allows potential identity spoofing via unsafe CN parsing
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...
com.aizuda:snail-job-client-common (>=1.7.2, <=1.8.0-jdk8), com.aizuda:snail-job-client-job-core (>=1.7.2, <=1.8.0-jdk8) +70 more potentially affected by CVE-2025-59328 via org.apache.fory:fory-core (>=0.11.0, <=0.12.1)
org.apache.fory:fory-core MAVEN version =0.11.0, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.8.0 and more Source cves: CVE-2025-59328 Source advisory: GHSA-5HMF-8WX5-4QQ3...
CVE-2023-53149
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock protecting ext4writepages calls to avoid races with switching of journalled data flag or inode format. This lock can however cause a deadlock...
CVE-2025-57104
Teampel 5.1.6 is vulnerable to SQL Injection in /Common/login.aspx...
com.aizuda:snail-job-client-common (>=1.7.2, <=1.8.0-jdk8), com.aizuda:snail-job-client-job-core (>=1.7.2, <=1.8.0-jdk8) +70 more potentially affected by CVE-2025-59328 via org.apache.fory:fory-core (>=0.11.0, <=0.12.1)
org.apache.fory:fory-core MAVEN version =0.11.0, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.7.2, =1.8.0 and more Source cves: CVE-2025-59328 Source advisory: SNYK:JAVA-ORGAPACHEFORY-12705076...
CVE-2025-38588
creationtimestamp| type| source ---|---|--- 2025-09-15 16:00:59+00:00| seen| Telegram/mEyglCHdbc3d2TNMQYMwOsN0NbABO0mU4FoEKo0-vo7aoKDx...
ROOT-OS-DEBIAN-11-CVE-2023-6603 CVE-2023-6603 in rootio-ffmpeg - Patched by Root
Root has patched CVE-2023-6603 in the rootio-ffmpeg package for Root:Debian:11. Multiple fixed versions available...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...
CVE
It is an information repository for CVE details, providing a col...
