PT-2025-38725

Name of the Vulnerable Software and Affected Versions IBM webMethods Integration versions 10.15 and 11.1 Description An authenticated user with execute Services permissions may be able to execute commands on the system. This is due to improper validation of format string strings received from an...

PT-2025-38988

Name of the Vulnerable Software and Affected Versions Mihdan: No External Links versions through 5.1.4 Description A Cross-Site Request Forgery CSRF issue exists in Mihdan: No External Links. This allows attackers to perform actions on behalf of unsuspecting users. Recommendations Update to a...

WordPress plugin AffiliateWP – External Referral Links 跨站脚本漏洞

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in the PHP language. WordPress plugin is an application plugin that provides the ability to host a personal blog site on a PHP and MySQL based server. A cross-site scripting vulnerability exists...

PT-2025-38996

Name of the Vulnerable Software and Affected Versions AffiliateWP – External Referral Links versions through 1.2.0 Description The software contains a flaw related to improper input handling during web page generation, specifically a Stored Cross-site Scripting issue. This allows for the injectio...

Linux Distros Unpatched Vulnerability : CVE-2023-53310

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288fuelgauge: Fix externalpowerchanged race fuelgaugeexternalpowerchanged...

CVE-2025-52159

creationtimestamp| type| source ---|---|--- 2025-09-19 21:58:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lz7ucqkb6u2g...

CVE-2025-34202

CVE-2025-34202 affects Vasion Print (Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518). The issue stems from exposing Docker internal networks, enabling an attacker on the same external L2 segment or one who can route via the appliance to reach container IPs directly. T...

CVE-2025-34202

Vasion Print formerly PrinterLogic Virtual Appliance Host prior to 25.2.169 and Application prior to 25.2.1518 VA and SaaS deployments expose Docker internal networks in a way that allows an attacker on the same external L2 segment — or an attacker able to add routes using the appliance as a...

Malicious code in fast-httpx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43be59be9c0005970f6a8a0cb80767f019ee690c675e81e7a40ed5672a175d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47470 Malicious code in oauthly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f51e9d4666c50bc7bc1a5f83811020d5da995fc251b9ec96a9ad3b8a3c6e2ecf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47465 Malicious code in internallib_v381 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e50fa16b8a33a721efa072a754b6d8bf5c3a9d981f48753a250a77ba202d1cfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Introducing Enhanced User Interface for Qualys PCI DSS 4.0 ASV Compliant Solution

We’re excited to introduce the new Qualys PCI ASV user interface, built to deliver a smarter, faster, and more intuitive experience. The redesigned PCI ASV UI helps you simplify PCI DSS 4.0 compliance, save time, and reduce audit-related stress. This major update improves usability, streamlines...

CVE-2025-59215

creationtimestamp| type| source ---|---|--- 2025-09-18 21:49:38+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115227503962306130 2025-09-19 06:33:42+00:00| seen| https://bsky.app/profile/secqube.com/post/3lz6andgc6n2u...

Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages

Summary We identified a cross-site scripting XSS vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. Any party capable of injecting content into chat messages, such as hosting a malicious page for prompt injection, operating ...

External Control of File Name or Path

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to External Control of File Name or Path via the GET /api/v1/images/download/bulkdownloaditemname...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not properly disabling the DMA use flag in the fsllpuart driver, which could lead to a synchronization...

SUSE CVE-2023-53343

In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6nullentry-rt6iidev in icmp6dev. With some IPv6 Ext Hdr RPL, SRv6, etc., we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ex...

CVE-2025-43802

Stored cross-site scripting XSS vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web...

CVE-2025-59154

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire’s SASL EXTERNAL mechanism for client TLS authentication contains a vulnerability in how it extracts user identities from X.509 certificates. Instead of parsing the structured ASN.1 data, the code calls...

CVE-2025-59347 Dragonfly Manager makes requests to external endpoints with disabled TLS authentication

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The Manager disables TLS certificate verification in HTTP clients. The clients are not configurable, so users have no way to re-enable the verification. A Manager processes dozens of preheat job...