OSV-2025-788 Heap-buffer-overflow in int arrow::bit_util::BitReader::GetBatch<int>

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=447480433 Crash type: Heap-buffer-overflow READ 8 Crash state: int arrow::bitutil::BitReader::GetBatch auto arrow::util::RleBitPackedDecoder::GetBatch std::1::pair arrow::util::R...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the mm/gup component in the Linux operating system’s kernel is related to the use of memory after it has been freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the getmodeaccess function in the landlock/fs.c component of the Linux kernel is related to insufficient input validation. Exploiting this vulnerability could allow an attacker to trigger a service failure using a modified file...

CVE-2025-7647

CVE-2025-7647 affects llama-index-core up to version 0.12.44, with a vulnerability in get_cache_dir() that uses a predictable, hardcoded directory path (/tmp/llama_index) on Linux. On multi-user Linux systems, this insecure temporary directory can enable local attackers to steal proprietary model...

CVE-2025-10036

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-59936

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

@erpsquad/common (>=1.0.0, <=1.10.3-spar), @faable/auth-helpers-fastify (>=1.0.2, <=1.0.17) +22 more potentially affected by CVE-2025-59936 via get-jwks (>=4.3.0, <=10.0.0)

get-jwks NPM version =4.3.0, =1.0.0, =1.0.2, =0.4.4, =1.0.0, =1.0.0, =1.0.1, =3.1.0, =2.0.0, =0.1.0, =0.29.0, =0.0.23, =0.0.23, =0.2.0, =0.33.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-59936 Source advisory: MEND:CVE-2025-59936...

CVE-2025-59936

The CVE-2025-59936 issue affects get-jwks prior to 11.0.2, where a design flaw allows cache poisoning of the JWKS cache to bypass issuer validation. If iss is validated after keys are retrieved from the cache, an attacker can craft JWTs to place a chosen public key in the shared cache and then re...

CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

CVE-2025-59936 get-jwks poisoned JWKS cache allows post-fetch issuer validation bypass

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

CVE-2025-59936: Improper Encoding or Escaping of Output

get-jwks contains fetch utils for JWKS keys. In versions prior to 11.0.2, a vulnerability in get-jwks can lead to cache poisoning in the JWKS key-fetching mechanism. When the iss issuer claim is validated only after keys are retrieved from the cache, it is possible for cached keys from an...

get-jwks security vulnerability

get-jwks is a Nearform open source utility for obtaining JWKS keys. A security vulnerability exists in get-jwks versions prior to 11.0.2, which stems from a cache poisoning issue in the JWKS key fetching mechanism that could lead to bypassing issuer authentication...

Improper Encoding or Escaping of Output

Overview get-jwks is a Fetch utils for JWKS keys Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getPublicKey process. An attacker can bypass issuer validation and gain unauthorized access by poisoning the JWKS cache with a crafted public key an...

CVE-2025-59936

creationtimestamp| type| source ---|---|--- 2025-09-26 13:51:53+00:00| published-proof-of-concept| https://github.com/nearform/get-jwks/security/advisories/GHSA-qc2q-qhf3-235m...

CVE-2025-10944

A weakness has been identified in yi-ge get-header-ip up to 589b23d0eb0043c310a6a13ce4bbe2505d0d0b15. This issue affects the function ip of the file ip.php. This manipulation of the argument callback causes cross site scripting. The attack may be initiated remotely. This product uses a rolling...

CVE-2025-10036

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-10036 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getallurls function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2025-10036

The FIFU (Featured Image from URL) WordPress plugin is affected by an authenticated SQL Injection vulnerability in get_all_urls() for versions up to and including 5.2.7. An Administrator+ attacker can inject additional SQL into existing queries to exfiltrate data. Patch information from connected...

CVE-2025-10037 Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to SQL Injection via the getpostswithinternalfeaturedimage function in all versions up to, and including, 5.2.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2025-10745

CVE-2025-10745 affects Banhammer – Monitor Site Traffic, Block Bad Users and Bots (WordPress) up to version 3.4.8. Root cause: a deterministically generated secret key (using md5 and base64_encode) stored in banhammer_secret_key enables unauthenticated bypass by appending a GET parameter banhamme...