gimp: PSD buffer overflow RCE

A parsing vulnerability was found in the GNU Image Manipulation Program GIMP. This flaw allows an unauthenticated, remote attacker to trick a GIMP user into opening a malicious PSD file, possibly enabling the execution of unauthorized code within the GIMP process...

CVE-2025-30672 Mite for Perl generates code with an untrusted search path vulnerability

Mite for Perl before 0.013000 generates code with the current working directory '.' added to the @INC path similar to CVE-2016-1238. If an attacker can place a malicious file in current working directory, it may be loaded instead of the intended file, potentially leading to arbitrary code...

PT-2025-7669 · Unknown · Phpgurukul Online Nurse Hiring System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Nurse Hiring System version 1.0 Description: A critical vulnerability has been found in the PHPGurukul Online Nurse Hiring System. This issue affects an unknown part of the file /admin/search-report-details.php. The...

CVE-2024-56362

Navidrome is affected by CVE-2024-56362, a vulnerability where the JWT secret is stored in plaintext in the navidrome.db database file under the property table. This insecure storage allows anyone with access to the database file to retrieve the secret, potentially enabling token forgery and acco...

CVE-2024-53276 GHSL-2024-092: Open CORS policy in home-gallery

Home-Gallery.org is a self-hosted open-source web gallery to browse personal photos and videos. In 1.15.0 and earlier, an open CORS policy in app.js may allow an attacker to view the images of home-gallery when it is using the default settings. The following express middleware allows any website ...

webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution

A flaw was found in WebKitGTK. Processing malicious web content can cause unexpected app termination or arbitrary code execution due to improper checks...

PT-2024-10886 · Opentext · Opentext Edirectory

Name of the Vulnerable Software and Affected Versions: OpenText eDirectory version 9.2.4.0000 Description: A Possible Insertion of Sensitive Information into Log File issue has been discovered in eDirectory. This issue affects the logging mechanism, potentially allowing sensitive information to b...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

PT-2024-38015 · Cato Networks · Cato Networks Sdp Client

Name of the Vulnerable Software and Affected Versions: Cato Networks SDP Client versions prior to 5.10.34 Description: A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover. However, the attack...

Malicious code in updated-tricks-roblox-robux-generator-2023-get-verify_4bbxd (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-20256 · Monoprice · Monoprice Select Mini V2

Name of the Vulnerable Software and Affected Versions: Monoprice Select Mini V2 version V37.115.32 Description: The issue arises from improper input validation of printing files, allowing attackers to instruct the device's movable parts to destinations beyond the device's maximum coordinates. Thi...

CVE-2023-38657

An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. A specially crafted .lxt2 file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability...

CVE-2023-35960

Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. A specially crafted wave file can lead to arbitrary command execution. A victim would need to open a malicious file to trigger these vulnerabilities.This vulnerability concerns legacy...

PT-2024-12749 · Gtkwave · Gtkwave

Name of the Vulnerable Software and Affected Versions: GTKWave version 3.3.115 Description: Multiple out-of-bounds write vulnerabilities exist in the VZT vzt rd get facname decompression functionality. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open...

PT-2023-29181 · Unknown · Online Art Gallery

Name of the Vulnerable Software and Affected Versions: Online Art Gallery version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. Specifically, the gender parameter of the header.php resource does not validate the characters received and they are sent...

PT-2024-13254 · Fortinet · Forticlientmac

Name of the Vulnerable Software and Affected Versions: FortiClientMac versions 7.2.3 and below FortiClientMac version 7.0.10 and below installer Description: The issue allows a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting...

CVE-2023-3417

Thunderbird allowed the Text Direction Override Unicode Character in filenames. An email attachment could be incorrectly shown as being a document file, while in fact it was an executable file. Newer versions of Thunderbird will strip the character and show the correct file extension. This...

CVE-2023-28161

If temporary "one-time" permissions, such as the ability to use the Camera, were granted to a document loaded using a file: URL, that permission persisted in that tab for all other documents loaded from a file: URL. This is potentially dangerous if the local files came from different sources, suc...

PT-2023-22292 · Unknown · Code-Projects Bus Dispatch/Information System

Name of the Vulnerable Software and Affected Versions: code-projects Bus Dispatch and Information System version 1.0 Description: A critical vulnerability has been found in the code-projects Bus Dispatch and Information System. The issue is related to an unknown function of the file delete bus.ph...

UBUNTU-CVE-2023-32076

in-toto is a framework to protect supply chain integrity. The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification. In versions 1.4.0 and prior, among the...