WordPress plugin Fast Flow has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-7829 · Fast Flow · Fast Flow

Name of the Vulnerable Software and Affected Versions: Fast Flow versions 1.2.16 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS attacks. Recommendations: For versions...

PT-2025-8701

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description A crash issue was identified, characterized as an UNKNOWN WRITE crash type. The crash occurred in the ndpi free flow data function, within the fuzz process packet.c file. No information is...

MAL-2025-1552 Malicious code in flow-inflation-client (npm)

This package runs commands on import that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e8b85d87e86c398459dbc07b5a2b235efca84f069f6656c40462a7c7783c7e2 Any computer that has this package installed or running...

Malicious code in flow-inflation-client (npm)

This package runs commands on import that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e8b85d87e86c398459dbc07b5a2b235efca84f069f6656c40462a7c7783c7e2 Any computer that has this package installed or running...

PT-2025-8700 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A crash occurred due to a check failure. The crash state includes CheckUnwind, ndpi free flow data, and is located in the fuzz process packet.c file. Recommendations: At the moment, there is...

WordPress Fast Flow plugin <= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Abdi Pranata Patchstack Alliance in WordPress Plugin Fast Flow versions = 1.2.16...

OSV-2025-147 UNKNOWN WRITE in ndpi_free_flow_data

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=397731142 Crash type: UNKNOWN WRITE Crash state: ndpifreeflowdata ndpiflowfree processndpicollectedinfo...

PT-2025-7665 · Git +1 · Ndpi

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN WRITE. The crash state involves several functions: ndpi free flow data, ndpi flow free, and process ndpi...

Insufficient Control Flow Management

Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Insufficient Control Flow Management due to the evaluation of iterator expressions in the loop body that can consume side effects from the loop iterations. An attacker can...

ntopng:fuzz_dissect_packet: Crash in Flow::processExtraDissectedInformation

Project: https://github.com/ntop/ntopng.git Detailed Report: https://oss-fuzz.com/testcase?key=5372142653079552 Project: ntopng Fuzzing Engine: libFuzzer Fuzz Target: fuzzdissectpacket Job Type: libfuzzerasanntopng Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00009fff8000 Crash...

CVE-2025-26620

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protoco...

Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

Summary Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other...

GHSA-QXJ7-2X7W-3MPP Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

Summary Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protocol parameters can return access tokens obtained with the wrong scope, resource indicator, or other...

GHSA-VQ63-8F72-F486 AspNetCore Remote Authenticator for CIE3.0 Allows SAML Response Signature Verification Bypass

Description Authentication using Spid and CIE is based on the SAML2 standard which provides for two entities: Identity Provider IdP: the system that authenticates users and provides identity information SAML assertions to the Service Provider, essentially, it is responsible for managing user...

The AspNetCore Remote Authenticator for SPID Allows SAML Response Signature Verification Bypass

Description Authentication using Spid and CIE is based on the SAML2 standard which provides for two entities: Identity Provider IdP: the system that authenticates users and provides identity information SAML assertions to the Service Provider, essentially, it is responsible for managing user...

CVE-2025-26620

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protoco...

CVE-2025-26620 Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protoco...

CVE-2025-26620 Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protoco...

CVE-2025-26620

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition when requesting access tokens using the client credentials flow. Concurrent requests to obtain an access token using differing protoco...