BIT-SUPERSET-2025-55674 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

A bypass of the DISALLOWEDSQLFUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leadi...

Linux Distros Unpatched Vulnerability : CVE-2018-5392

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigation technique used by...

Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasourceid in the URL, an attacker can...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-54698 WordPress Classified Listing Plugin plugin <= 5.0.0 - Content Injection Vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in RadiusTheme Classified Listing allows Code Injection. This issue affects Classified Listing: from n/a through 5.0.0...

CVE-2025-27577

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition...

CVE-2025-20090

CVE-2025-20090 describes an untrusted pointer dereference in Intel(R) QuickAssist Technology software prior to version 2.5.0, which may allow an authenticated user to potentially cause a local-denial-of-service. Affected product: Intel QuickAssist Technology software before 2.5.0. Root cause: unt...

CVE-2025-20090

Untrusted Pointer Dereference for some IntelR QuickAssist Technology software before version 2.5.0 may allow an authenticated user to potentially enable denial of service via local access...

Adobe Substance3D Sampler 缓冲区错误漏洞

Adobe Substance3D Sampler is a software for rendering 3D scenes from Audobee Adobe USA. A buffer error vulnerability exists in Adobe Substance3D Sampler version 5.0.3 and prior versions, which originates from an out-of-bounds read and could lead to a sensitive memory leak...

GHSA-RFG4-2M63-FW2Q Mattermost Confluence Plugin has Missing Authorization vulnerability

Mattermost Confluence Plugin versions 1.5.0 fail to enforce authentication of the user to the Mattermost instance, which allows unauthenticated attackers to access subscription details via an API call to the GET subscription endpoint...

CVE-2025-27562

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory...

CVE-2025-27577

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through race condition...

CVE-2025-27536

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through type confusion...

CVE-2025-24298

in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in tcb through use after free...

CVE-2025-27562 communication_dsoftbus has a missing release of memory vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory...

CVE-2025-25212 pasteboard has an improper input vulnerability

in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through improper input...

CVE-2025-24844

The CVE-2025-24844 entry involves OpenHarmony, affected in v5.0.3 and earlier. The root cause is a missing release of memory, leading to a local denial-of-service condition (availability impact), as described by multiple sources. Exploitation is local with low attack complexity and low privileges...

OpenHarmony 竞争条件问题漏洞

OpenHarmony is a kind of Hongmeng operating system open source project of China OpenAtom OpenAtom Foundation. A competitive condition issue vulnerability exists in OpenHarmony v5.0.3 and earlier versions, which stems from a competitive condition in tcb that could lead to the execution of arbitrar...

PT-2025-32509 · Openharmony · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 5.0.4 Description: The software contains a flaw that allows a local attacker to execute arbitrary code within the tcb component due to a race condition. Recommendations: Update to OpenHarmony version 5.0.4 or lat...