Google Chrome V8 Engine Data Compromise

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to reading beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to exploit the accessibility of protected information...

Fluent Bit Plugin Information Disclosure

The vulnerability of plugins inhttp, insplunk, and inelasticsearch, which are tools for collecting and processing logs with Fluent Bit, is related to improper type checking of input data when processing the tagkey parameter. Exploitation of this vulnerability can allow an attacker to disclose and...

Keymaster Component Privilege Escalation

The vulnerability of the Keymaster component of MediaTek’s microprogramming software lies in the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to enhance their privileges and expose sensitive information...

DA Component Privilege Escalation

The vulnerability of the DA component of MediaTek’s microprogramming software lies in the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to enhance their privileges and expose sensitive information...

GHSA-XMH7-35V2-FP6H Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The...

Skuul School Management System has a Sensitive Data Exposure Vulnerability in Uploaded Images

A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.5. This issue affects some unknown processing of the file /user/profile of the component Image Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The...

WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

WordPress Masteriyo - LMS plugin = 2.0.3 - Sensitive Data Exposure vulnerability discovered by daroo in WordPress Plugin Masteriyo - LMS versions = 2.0.3...

Exploit for CVE-2025-65900

CVE-2025-65900: Kalmia CMS v0.2.0 - is vulnerable to Incorrect...

CVE-2025-66422

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back server setup information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

SROOT Component Unauthorized Access

The vulnerability of the SROOT component in NVIDIA DGX OS workstations for AI systems, such as DGX Spark, is related to errors in boundary removal of critical data. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information...

Rallly 安全漏洞

Rallly is a scheduling and collaboration tool by Luke Vella Individual Developer designed to make it easier to organize events and meetings. A security vulnerability exists in Rallly versions prior to 4.5.6, which stems from the disclosure of /api/trpc/polls.get,polls.participants.list endpoint...

CVE-2025-12584

The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqvpopupcontent' AJAX endpoint due to insufficient restrictions on which products can be included. This makes it possible for unauthenticated attackers t...

CVE-2025-66361

An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load...

Peppol-py is vulnerable to XXE attacks due to Saxon configuration

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

Sanitization Bypass

python-ldap is vulnerable to Sanitization Bypass. The vulnerability is due to improper escaping in escapefilterchars when escapemode=1 is used, where crafted list or dict inputs bypass character escaping due to missing type validation, and attackers can exploit this to inject malicious LDAP filte...

CVE-2025-66371

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

ROS-20251128-06

A vulnerability in the adevrelease function in the drivers/peci/cpu.c module of the Platform Environment Control driver Interface PECI module of the Linux kernel is related to the reuse of previously released memory. memory. Exploitation of the vulnerability could allow an attacker to impact the...

EUVD-2025-199852

Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host...

WordPress Ultimate Member Widgets for Elementor plugin <= 2.3 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Mdr in WordPress Plugin Ultimate Member Widgets for Elementor versions = 2.3...

CVE-2025-59454 Apache CloudStack: Lack of user permission validation leading to data leak for few APIs

In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHistory - listVolumesUsageHistory While these APIs were accessible only to authorized users, insufficient permission validation meant that...