thrift:fuzz_roundtrip_json: Crash in ___interceptor_pthread_create

Detailed Report: https://oss-fuzz.com/testcase?key=5302029649248256 Project: thrift Fuzzing Engine: libFuzzer Fuzz Target: fuzzroundtripjson Job Type: libfuzzerasanthrift Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x10c0000028c0 Crash State: interceptorpthreadcreate...

CVE-2025-15108

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

CVE-2025-15108 PandaXGO PandaX JWT Secret config.yml hard-coded key

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

CVE-2025-15108 PandaXGO PandaX JWT Secret config.yml hard-coded key

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

EUVD-2025-205477

A vulnerability was detected in PandaXGO PandaX up to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5. This affects an unknown function of the file config.yml of the component JWT Secret Handler. The manipulation of the argument key results in use of hard-coded cryptographic key . The attack may be...

EUVD-2025-205475

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is...

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key. The attack is...

Use of Hard-coded Cryptographic Key

Overview Affected versions of this package are vulnerable to Use of Hard-coded Cryptographic Key via the JWTSecretKey argument in the JWT Secret Handler. An attacker can gain unauthorized access to sensitive information by exploiting the use of a hard-coded cryptographic key in remote requests...

CVE-2025-15107

CVE-2025-15107 affects actiontech sqle up to 4.2511.0, specifically the JWT Secret Handler in sqle/utils/jwt.go. The vulnerability arises from the manipulation of the argument JWTSecretKey, leading to use of a hard-coded cryptographic key. Reported as remotely exploitable with high attack complex...

CVE-2025-15107 actiontech sqle JWT Secret jwt.go hard-coded key

A security vulnerability has been detected in actiontech sqle up to 4.2511.0. The impacted element is an unknown function of the file sqle/utils/jwt.go of the component JWT Secret Handler. The manipulation of the argument JWTSecretKey leads to use of hard-coded cryptographic key . The attack is...

Exploit for Improper Verification of Cryptographic Signature in Fortinet Fortiproxy

CVEs: CVE-2025-59718 / CVE-2025-59719 Fortinet Poc Herramient...

PT-2025-53624

Name of the Vulnerable Software and Affected Versions PandaXGO PandaX versions prior to fb8ff40f7ce5dfebdf66306c6d85625061faf7e5 Description A security issue exists in PandaXGO PandaX related to the JWT Secret Handler component. The issue involves the manipulation of the key argument within the...

PT-2025-53619

Name of the Vulnerable Software and Affected Versions actiontech sqle versions up to 4.2511.0 Description A security issue has been identified in actiontech sqle. The issue resides in an unknown function within the sqle/utils/jwt.go file of the JWT Secret Handler component. Manipulation of the...

llama_index JSON Reader DoS

The vulnerability of the llamaindex component of the JSON data reading class, implemented through JSONReader tokens, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...

unit:fuzz_json: Heap-buffer-overflow in nxt_inet_addr

Detailed Report: https://oss-fuzz.com/testcase?key=5543399496417280 Project: unit Fuzzing Engine: libFuzzer Fuzz Target: fuzzjson Job Type: libfuzzerasanunit Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x7710559e07bf Crash State: nxtinetaddr...

CVE-2018-25128 SOCA Access Control System 180612 SQL Injection and Authentication Bypass

SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by...

CVE-2018-25128 SOCA Access Control System 180612 SQL Injection and Authentication Bypass

SOCA Access Control System 180612 contains multiple SQL injection vulnerabilities that allow attackers to manipulate database queries through unvalidated POST parameters. Attackers can bypass authentication, retrieve password hashes, and gain administrative access with full system privileges by...

CVE-2018-25128

The CVE-2018-25128 entry concerns the SOCA Access Control System 180612, where unvalidated POST parameters enable multiple SQL injection flaws in Login.php and Card_Edit_GetJson.php. The root cause is injection into queries, allowing attackers to bypass authentication, retrieve password hashes, a...

CVE-2025-68665

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON method and subsequently when string-ifying objects using...

CVE-2025-68665 LangChain serialization injection vulnerability enables secret extraction

LangChain is a framework for building LLM-powered applications. Prior to @langchain/core versions 0.3.80 and 1.1.8, and prior to langchain versions 0.3.37 and 1.2.3, a serialization injection vulnerability exists in LangChain JS's toJSON method and subsequently when string-ifying objects using...