CVE-2025-9301

A reachable assertion flaw has been discovered in the Cmake build system. A local attacker who can construct crafted input could reach this assertion and cause a program crash. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

Regular Expression Denial of Service (ReDoS)

Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the setOptions function in the src/util/request-manager.js file. An attacker can cause resource exhaustion by supplying crafted input that...

sha.js is missing type checks leading to hash rewind and passing on crafted data

Summary This is the same as GHSA-cpq7-6gpm-g9rc but just for sha.js, as it has its own implementation. Missing input type checks can allow types other than a well-formed Buffer or string, resulting in invalid values, hanging and rewinding the hash state including turning a tagged hash into an...

ROS-20250821-02

A vulnerability in the BinaryStreamDriver component of the Java library for converting objects to XML or JSON XStream format is related to a buffer overflow on the stack from a manipulated binary input stream. Exploitation of the vulnerability could allow an attacker acting remotely to perform a...

Function Call With Incorrect Argument Type

Overview Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type due to missing type checks in the update function in the hash.js file. An attacker can manipulate input data by supplying crafted data that causes a hash rewind and unintended data processing...

Function Call With Incorrect Argument Type

Overview Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type due to missing type checks in the update function in the hash.js file. An attacker can manipulate input data by supplying crafted data that causes a hash rewind and unintended data processing...

CVE-2025-54927

CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system...

UBUNTU-CVE-2025-54364

Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. optiondescriptions employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings containing a...

Linux Distros Unpatched Vulnerability : CVE-2020-12135

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bson before 0.8 incorrectly uses int rather than sizet for many variables, parameters, and return values. In particular, the bsonensurespace parameter bytesNeed...

Linux Distros Unpatched Vulnerability : CVE-2022-40151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may...

CVE-2025-9136

A flaw was found in RetroArch. This vulnerability allows a local attacker to trigger an out-of-bounds read via a crafted input to the filestreamvscanf function in the libretro-common/streams/filestream.c file due to a missing initialization, resulting in a denial of service...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.bower:angular-sanitize is an AngularJS module for sanitizing HTML Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the linky filter. An attacker can cause excessive resource consumption and degrade application performance by...

Regular Expression Denial of Service (ReDoS)

Overview angular-sanitize is an AngularJS module for sanitizing HTML Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the linky filter. An attacker can cause excessive resource consumption and degrade application performance by submitting speciall...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:angular-sanitize is an AngularJS module for sanitizing HTML Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the linky filter. An attacker can cause excessive resource consumption and degrade application performance by...

CVE-2025-55588

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fwip parameter at /boafrm/formPortFw. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-55587

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

Cross-site Scripting (XSS)

Overview zencart/zencart is an Open Source E-commerce Application Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CKEditor component. An attacker can inject and execute unauthorized scripts by submitting crafted input as an authorized administrator. Note: The...

CVE-2025-55586

CVE-2025-55586 affects TOTOLINK A3002R v4.0.0-B20230531.1404. The flaw is a buffer overflow in the url parameter of /boafrm/formFilter, leading to a Denial of Service when fed with crafted input. The available sources confirm the issue but do not provide a definitive patch; PT-Security notes ther...

CVE-2025-55587

TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...

Linux Distros Unpatched Vulnerability : CVE-2018-1999012

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FFmpeg before commit 9807d3976be0e92e4ece3b4b1701be894cd7c2e1 contains a CWE-835: Infinite loop vulnerability in pva format demuxer that can result in a...