CVE-2025-13947

Concrete details: CVE-2025-13947 affects WebKitGTK/WebKitGTK4 where drag-and-drop operations aren’t verified to originate outside the browser, enabling remote, user-assisted information disclosure of files the user can read. The issue is addressed in multiple distros: Amazon Linux 2/AL2 packages ...

CVE-2025-65843

Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation. The product follows symbolic links placed in ~/Library/Logs/Aquarius and treats them as regular files. While building the support ZIP, a JUCE directory iterator configured t...

CVE-2025-65843

Aquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The application follows symbolic links placed inside the /Library/Logs/Aquarius directory and treats them as regular files. When building the support ZIP, Aquarius...

PluckCMS 4.7.10 - Unrestricted File Upload

Exploit Title: PluckCMS 4.7.10 - Unrestricted File Upload Date: 2025-11-25 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/pluck-cms/pluck/ Software Link: https://github.com/pluck-cms/pluck/ Version: 4.7.10 Tested on: Windows CVE : CVE-2020-20969 Proof Of Concept GET...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the VersionManager.php extension upload process. An attacker can access arbitrary files on the server by supplying crafted input to the file inclusion mechanism. Remediation There is no fixed version for...

GHSA-58W6-W55X-6WQ8 Mattermost fails to validate user permissions in Boards

Mattermost versions 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does...

Privilege Context Switching Error

Overview Affected versions of this package are vulnerable to Privilege Context Switching Error in the current user session. An attacker can gain unauthorized access to files and subscribe to blocks belonging to other users by sending crafted requests as an authenticated user. Remediation Upgrade...

Privilege Context Switching Error

Overview Affected versions of this package are vulnerable to Privilege Context Switching Error in the current user session. An attacker can gain unauthorized access to files and subscribe to blocks belonging to other users by sending crafted requests as an authenticated user. Remediation Upgrade...

CVE-2025-13870

Mattermost fix exists for CVE-2025-13870. Affected: Mattermost Server versions 10.11.x <= 10.11.4 and 10.5.x

CVE-2025-13870 Unauthorized access and subscription vulnerability in Boards

Mattermost versions 10.11.x = 10.11.4, 10.5.x = 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authenticated user to access other board files and was able to subscribe to the block from other boards that the user does...

Directory Traversal

Overview gapless-crypto-clickhouse is a ClickHouse-based cryptocurrency data collection with zero-gap guarantee. 22x faster via Binance public repository with persistent database storage, USDT-margined futures support, and production-ready ReplacingMergeTree schema. Affected versions of this...

Directory Traversal

Overview gapless-crypto-data is a Cryptocurrency OHLCV data collection with gap-free guarantee. Retrieves microstructure-enriched kline data from Binance Public Data Repository with automatic gap detection and filling. Affected versions of this package are vulnerable to Directory Traversal due to...

Directory Traversal

Overview flamehaven-filesearch is a FLAMEHAVEN FileSearch - Open source semantic document search with API authentication powered by Google Gemini Affected versions of this package are vulnerable to Directory Traversal due to insufficient validation and sanitization of user-controlled filenames in...

Exploit for CVE-2025-65321

CVE-2025-65321 The Language Sloth Discord bot is vulnerable to...

CVE-2025-21080

Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege...

Gin-vue-admin has an arbitrary file deletion vulnerability

Impact Attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder The affected code: Affected interfaces: /api/fileUploadAndDownload/removeChunk POC: You can specify the...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability exists in Samsung Mobile Devices that stems from improperly exported Android application components, which could lead to file...

PT-2025-48592

Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Lockscreen's privilege...

📄 Language Sloth Directory Traversal

The Language Sloth Discord bot has been found susceptible to a directory traversal vulnerability. CVE-2025-65321 The Language Sloth Discord bot is vulnerable to Directory Traversal in the gif and png functions. The functions build file paths using unsanitized user input for the 'name' parameter,...

CVE-2025-66410 Gin-vue-admin has an arbitrary file deletion vulnerability

Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage or unavailability of server resources. Attackers can control the 'FileMd5' parameter to delete any file and folder...