30672 matches found
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dataAddonlayouts and dataAddonlayoutsexcept parameters in the /apprain/developer/addons/update/richtexteditor process. An attacker can execute arbitrary JavaScript code in the context of another user by...
Insecure parsing of Windows paths with a \??\ prefix in path/filepath
...
Command 'go get' may unexpectedly fallback to insecure git in cmd/go
...
CVE-2025-6984
CVE-2025-6984 (LangChain EverNoteLoader XXE) : The langchain-ai/langchain package’s EverNoteLoader is vulnerable to XML External Entity (XXE) attacks due to insecure XML parsing. The affected version is 0.3.63, where etree.iterparse() is used without disabling external entity processing, enabling...
CVE-2025-56254
PHPGurukul Employee Leave Management System 2.1 contains an Insecure Direct Object Reference IDOR vulnerability in leave-details.php. An authenticated user can change the leaveid parameter in the URL to access leave application details of other users...
CVE-2025-32098
An issue was discovered in Samsung Magician 6.3 through 8.3 on Windows. An attacker can achieve Elevation of Privileges to SYSTEM by exploiting insecure file delete operations during the update process...
LangChain 信息泄露漏洞
LangChain is a LangChain open source framework for developing applications powered by the Large Language Model LLM. An information disclosure vulnerability exists in LangChain version 0.3.63, which stems from insecure XML parsing and could lead to the disclosure of sensitive information...
PT-2025-36040
Name of the Vulnerable Software and Affected Versions: LocalBluetoothLeBroadcast.java affected versions not specified Description: An issue exists in the generateRandomPassword function of LocalBluetoothLeBroadcast.java that may allow interception of the Auracast audio stream due to an insecure...
PT-2025-36082
Name of the Vulnerable Software and Affected Versions: RemoteFillService.java affected versions not specified Description: The RemoteFillService.java component contains a flaw in the onNullBinding function related to an insecure default value. This can result in unauthorized background activity...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an information disclosure vulnerability caused by an insecure default value flaw in the generateRandomPasword function in LocalBluetoothLeBroadcast.java. An attacker can exploit the leak to obtai...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
Summary Python class pollution is a novel vulnerability categorized under CWE-915. The Delta class is vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it can lead to Denial of Service and Remote Code Execution via insecure Pickle...
When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have silently failed. This could have led to a desynchronization in expected results when reading from the secure cookie. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
...
Creation of Temporary File With Insecure Permissions
Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the getorcreatetmpdir function in fileutils.py. This enables an attacker who can write to /tmp to cause the execution of arbitrary .py files during environment setup. Remediation...
Creation of Temporary File With Insecure Permissions
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the...
WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability
Insecure Direct Object References IDOR Vulnerability discovered by Muhammad Zidan Ali Mansur in WordPress Plugin wpForo Forum versions = 2.4.6...
CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Remote Code Execution RCE.This issue affects Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform XP: from 9.0 through 9.3, from 10.0 throu...
CVE-2025-53691 Sitecore Experience Remote Code Execution through Insecure Deserialization
Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager XM, Sitecore Experience Platform XP allows Remote Code Execution RCE.This issue affects Experience Manager XM: from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform XP: from 9.0 through 9.3, from 10.0 throu...
