24173 matches found
Privilege Escalation
PyInstaller is vulnerable to Privilege Escalation. The vulnerability is due to the bootstrap process appending a special entry to sys.path and attempting to load an optional bytecode-decryption module while that entry is present, which allows an attacker who can create files/directories next to t...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987621)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987621 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for formatcount earlier While the check for formatcount 64 in...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-987537)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-987537 advisory. In the Linux kernel, the following vulnerability has been resolved: powerpc/secvar: fix refcount leak in formatshow Refcount leak will happen when formatshow returns...
Moodle GeniAI plugin å®å Øę¼ę“
Moodle GeniAI plugin is a large modeling plugin for Moodle open source. A security vulnerability exists in Moodle GeniAI plugin version 2.3.6, which stems from an uncleaned JavaScript embedded in PDF files and could lead to a cross-site scripting attack...
CVE-2025-11896
A flaw was found in Xpdf. A PDF object loop in a CMap, via the "UseCMap" entry leads to an infinite recursion and a stack overflow, resulting in an application crash...
EUVD-2025-35044
Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...
JLSEC-2025-160 A flaw was found in GLib
A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service...
JLSEC-2025-103 A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU...
A denial of service in the subtitle decoder in FFmpeg 3.2 and 4.1 allows attackers to hog the CPU via a crafted video file in Matroska format, because handleopenbrace in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...
JLSEC-2025-101 FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in...
FFMPEG version 4.1 contains a CWE-129: Improper Validation of Array Index vulnerability in libavcodec/cbsav1.c that can result in Denial of service. This attack appears to be exploitable via specially crafted AV1 file has to be provided as input. This vulnerability appears to have been fixed in...
JLSEC-2025-148 A flaw was found in FFmpeg
A flaw was found in FFmpeg. This vulnerability allows unexpected additional CPU load and storage consumption, potentially leading to degraded performance or denial of service via the demuxing of arbitrary data as XBIN-formatted data without proper format validation...
JLSEC-2025-102 In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU...
In FFmpeg 3.2 and 4.1, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because ffhtmlmarkuptoass in libavcodec/htmlsubtitles.c has a complex format argument to sscanf...
vulnlog-poc
Vulnlog Proof of Concepts YAML and JSON Schema PoC - y...
EUVD-2025-34911
An arbitrary file upload vulnerability in SigningHub v8.6.8 allows attackers to execute arbitrary code via uploading a crafted PDF file...
CVE-2025-11896
In Xpdf 4.05 and earlier, a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow...
CVE-2025-11568
A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the...
EUVD-2021-34646
In the Linux kernel, the following vulnerability has been resolved: drm/plane: Move range check for formatcount earlier While the check for formatcount 64 in drmuniversalplaneinit shouldn't be hit it's a WARNON, in its current position it will then leak the plane-formattypes array and fail to cal...
MAL-2025-48319 Malicious code in pretty-format-setting (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98ad5e7fdf5539b67cf7d13f5634890ff9db4c4ef4eafed348b91d26b8a6982d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview pretty-format-setting is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in pretty-format-setting (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98ad5e7fdf5539b67cf7d13f5634890ff9db4c4ef4eafed348b91d26b8a6982d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...