17533 matches found
GE UR family Insecure Default Variable Initialization (CVE-2021-27426)
GE UR IED firmware versions prior to version 8.1x with Basic security variant does not allow the disabling of the Factory Mode, which is used for servicing the IED by a Factory user. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
AlmaLinux 8 : python3 (ALSA-2025:14560)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:14560 advisory. cpython: Cpython infinite loop when parsing a tarfile CVE-2025-8194 Tenable has extracted the preceding description block directly from the AlmaLinux security...
PT-2025-39921
Name of the Vulnerable Software and Affected Versions MinIO Java SDK versions prior to 8.6.0 Description The MinIO Java SDK is a client for performing bucket and object operations with Amazon S3 compatible object storage services. Versions prior to 8.6.0 improperly handle XML tag values containin...
RHEL 8 : mysql:8.0 (RHSA-2025:16861)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2025:16861 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and...
GE UR family Exposure of Sensitive Information to an Unauthorized Actor (CVE-2021-27424)
GE UR firmware versions prior to version 8.1x shares MODBUS memory map as part of the communications guide. GE was made aware a Last-key pressed MODBUS register can be used to gain unauthorized information. This plugin only works with Tenable.ot. Please visit...
MINI-8V29-M4QX-MRCQ
Bulletin has no description...
CVE-2025-9896
The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a...
Takedown: How It's Done in Modern Coding Agent Exploits
Coding agents, which are LLM-driven agents specialized in software development, have become increasingly prevalent in modern programming environments. Unlike traditional AI coding assistants, which offer simple code completion and suggestions, modern coding agents tackle more complex tasks with...
Exploit for Path Traversal in Fckeditor
PoC exploit for CVE-2009-2265, an Adobe ColdFusion 8 remote code...
CVE-2025-60110
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through = 3.8...
CVE-2025-60156
Cross-Site Request Forgery CSRF vulnerability in webandprint AR For WordPress ar-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects AR For WordPress: from n/a through = 8.36...
CVE-2025-60100
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through 9.6...
PT-2025-39698
Name of the Vulnerable Software and Affected Versions Wazuh versions 3.8.0 through 4.10.9 Description Wazuh, a platform for threat prevention, detection, and response, contains a heap buffer overflow in the wazuh-analysisd component. This issue occurs when parsing XML elements received from Windo...
CVE-2025-59842
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener...
CVE-2025-59842 JupyterLab LaTeX typesetter links did not enforce `noopener` attribute
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to version 4.4.8, links generated with LaTeX typesetters in Markdown files and Markdown cells in JupyterLab and Jupyter Notebook did not include the noopener...
Malicious code in pnpm_prune_lockfile_v8 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-47714 Malicious code in pnpm_lockfile_file_v8 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in pnpm_lockfile_file_v8 (npm)
--- -= Per source details. Do not edit below this line.=-...
WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled
A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration, the system returns a distinct "User does not exist" error message to the login form, regardless of the validateusername setting. This behavior allows malicious actor...