Arbitrary File Write via Archive Extraction (Zip Slip)

Overview gluoncv is a Gluon CV Toolkit Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the fromcsv function in ImageClassificationDataset. An attacker can overwrite files on the victim's system by using this function to extract maliciou...

CVE-2024-9216

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secu...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. A server-side request forgery vulnerability exists in the GPT Academic crazyutils.getfilesfromeverything function, which can be exploited by an attacker to cause unauthorized access to...

Vulnerability of the function bt1_rom_map_copy_from(), located in the driver/mtd/maps/physmap-bt1-rom.c module. This driver provides support for accessing memory devices in Linux kernels, which can be exploited by attackers to compromise confidentiality.

The vulnerability of the bt1rommapcopyfrom function in the drivers/mtd/maps/physmap-bt1-rom.c module – the driver for accessing memory devices in Linux kernels – involves reading beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to compromise confidentiality...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of credentials being passed as parameter values when registering a new user via the OpenTelemetry endpoint. These values may be passed in a cache-to/cache-from configuration a...

The vulnerabilities of the functions php_libxml_input_buffer_create_filename() and php_libxml_sniff_charset_from_stream() in the PHP interpreter allow a hacker to redirect users to any desired URL address.

The vulnerabilities of the functions phplibxmlinputbuffercreatefilename and phplibxmlsniffcharsetfromstream in the PHP interpreter are related to the use of open redirection. Exploiting these vulnerabilities could allow a malicious actor to redirect users to any desired URL address...

SUSE CVE-2025-1767

This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remai...

PT-2025-18405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between mhi unprepare from transfer and mhi queue buf functions. When a client driver uses mhi unprepare from transfer to quiesce incoming data during its teardow...

Arbitrary Code Injection

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Arbitrary Code Injection via the GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load processes. An attacker can execute arbitrary code by loading a crafted GraphQL schema...

WordPress List of Posts from each Category plugin for WordPress plugin <= 2.0 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin List of Posts from each Category plugin for WordPress versions = 2.0...

CVE-2025-28894: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through = 2.0...

CVE-2024-13906

The Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.7.3 via deserialization of untrusted input in the 'importgalleryfromcsv' function. This makes it possible for...

CVE-2023-25595

creationtimestamp| type| source ---|---|--- 2025-02-27 19:26:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/5768 2025-03-02 11:44:19+00:00| seen| Telegram/SIMmZQhYIEeKMqhLg9o7PdsHUQcJerphdd-ZqBd5BMWR8D8V...

SUSE CVE-2022-49385

In the Linux kernel, the following vulnerability has been resolved: driver: base: fix UAF when driverattach failed When driverattachdrv; failed, the driverprivate will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed...

PT-2025-21185

Name of the Vulnerable Software and Affected Versions: Thunderbird versions prior to 128.10.1 Thunderbird versions prior to 138.0.1 Description: The issue allows sender spoofing if the server permits an invalid From address. For example, if the From header contains an invalid value, Thunderbird...

Medium: harfbuzz

Issue Overview: HarfBuzz is a text shaping engine. Starting with 8.5.0 through 10.0.1, there is a heap-based buffer overflow in the hbcairoglyphsfrombuffer function. CVE-2024-56732 Affected Packages: harfbuzz Issue Correction: Run dnf update harfbuzz --releasever 2023.6.20250218 or dnf update...

CVE-2025-1065: Improper Neutralization of Input During Web Page Generation

The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From File feature in all versions up to, and including, 3.11.8 due to insufficient input sanitization and output escaping on user supplied...

WordPress plugin Post SMTP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-0521: Improper Neutralization of Input During Web Page Generation

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the from and subject parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-23525

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in kvvaradha Kv Compose Email From Dashboard kv-send-email-from-admin allows Reflected XSS.This issue affects Kv Compose Email From Dashboard: from n/a through = 1.1...