CVE-2025-48721

CVE-2025-48721 describes a buffer overflow affecting QNAP OS such as QTS and QuTS hero. Connected documents confirm a vulnerability where a remote attacker who already has an administrator account can trigger memory modification or process crashes. The issue is mitigated by fixes introduced in QT...

CVE-2025-53590

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the...

CVE-2025-44013 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service DoS attack. We have already fixed the vulnerability in the following...

CVE-2025-62857

CVE-2025-62857 affects QuMagie with a cross-site scripting (XSS) vulnerability. Affected versions are prior to 2.8.1; remediation is to upgrade to QuMagie 2.8.1 or later. Multiple sources (NVD, Red Hat, CVE lists, CNVD, EUVD, PT Security) corroborate the issue and fix. The provided documents do n...

CVE-2025-69288

Titra is open source project time tracking software. Prior to version 0.99.49, Titra allows any authenticated Admin user to modify the timeEntryRule in the database. The value is then passed to a NodeVM value to execute as code. Without sanitization, it leads to a Remote Code Execution. Version...

CVE-2026-21437

eopkg is a Solus package manager implemented in python3. In versions prior to 4.4.0, a malicious package could include files that are not tracked by eopkg. This requires the installation of a package from a malicious or compromised source. Files in such packages would not be shown by lseopkg and...

PT-2026-20919

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 1.14.4-2 Description HDF5 is software used for managing data. An attacker controlling an h5 file parsed by HDF5 can trigger a write-based heap buffer overflow. This can lead to a denial-of-service condition, and...

PT-2026-24139

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-16 Description ImageMagick is software used for editing and manipulating digital images. A heap-based buffer overflow exists in the UHDR encoder due to truncation of a value, which could allow an out-of-boun...

WordPress Knowband Mobile App Builder for wooCommerce plugin < 3.0.0 - Unauthenticated Arbitrary User Deletion vulnerability

Unauthenticated Arbitrary User Deletion vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Knowband Mobile App Builder versions 3.0.0...

CVE-2025-69257 theshit vulnerable to unsafe loading of user-owned Python rules when running as root.

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom Python rules and configuration files from user-writable locations e.g., /.config/theshit/ without validating ownership or permissions when...

UBUNTU-CVE-2025-68618

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG file resulted in a DoS attack. Version 7.1.2-12 fixes the issue...

CVE-2025-69204 ImageMagick converting a malicious MVG file to SVG caused an integer overflow.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using an int variable to store numberattributes caused an integer overflow. This, in turn, triggered a buffer overflow and caused a DoS attack...

WordPress WPCal.io plugin <= 0.9.5.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin WPCal.io versions = 0.9.5.9...

WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerability

Software : Fana Type : Theme Vulnerable versions : = 1.1.35 Fixed in : 1.1.36 OWASP Top 10 : A3: Injection Classification : Local File Inclusion CVE ID : CVE-2025-68540 Patchstack priority : Low CVSS severity : 7.5 Required privilege : Contributor Developer : Claim ownership PSID : 1370613da8d7...

PT-2025-53682

Name of the Vulnerable Software and Affected Versions Tenda AC10U versions 15.03.06.48 through 15.03.06.49 Description A buffer overflow issue exists in the Tenda AC10U. The vulnerability is located in the fromadvsetlanip function within the /goform/AdvSetLanip file, specifically within the POST...

Use of Hard-coded Cryptographic Key

Overview Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key via the JWTSecretKey argument in the JWT Secret Handler. An attacker can gain unauthorized access to sensitive information by exploiting the use of a hard-coded cryptographic key in remote requests...

Slackware Linux 15.0 / current vim Vulnerability (SSA:2025-361-01)

The version of vim installed on the remote host is prior to 9.1.2028. It is, therefore, affected by a vulnerability as referenced in the SSA:2025-361-01 advisory. New vim packages are available for Slackware 15.0 and -current to fix a security issue. Tenable has extracted the preceding descriptio...

WordPress Brands for WooCommerce plugin <= 3.8.6.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by 0xd4rk5id3 in WordPress Plugin Brands for WooCommerce versions = 3.8.6.3...

WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

Arbitrary File Upload vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin Contentstudio versions = 1.3.7...

Arbitrary Code Injection

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Arbitrary Code Injection via the convertconfig function. An attacker can execute arbitrary code by supplying a malicious checkpoint file that is process...