The vulnerability of the chacha20_poly1305_set_key() function in the libssh library, which allows a hacker to disclose sensitive information

The vulnerability of the chacha20poly1305setkey function in the libssh library is related to the lack of checking for the returned value. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

Julia URIs.jl 注入漏洞

Julia URIs.jl is a Julia open source library for Julia. An injection vulnerability exists in Julia URIs.jl versions prior to 1.6.0 and HTTP.jl versions prior to 1.10.17, which stems from allowing the construction of URIs containing CRLF characters, potentially leading to a CRLF injection attack...

Advisory ROSA-SA-2025-2896

Software: zlib 1.2.7 OS: rosa-server79 packageevrstring: zlib-1.2.7-21.0.1.res7 CVE-ID: CVE-2025-4638 BDU-ID: None CVE-Crit: DATA LOSSES. CVE-DESC.: A vulnerability in the zlib library embedded in PointCloudLibrary PCL allows attackers to cause undefined behavior via incorrect pointer arithmetic...

The vulnerability of the QBRM library in the IBM Backup, Recovery, and Media Services (BRMS) operating system for IBM i allows a perpetrator to escalate their privileges and execute arbitrary code.

The vulnerability of the QBRM library in the IBM Backup, Recovery, and Media Services BRMS operating system involves deficiencies in access control. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary code...

BELL-CVE-2025-38033

Bulletin has no description...

Vulnerability of the gsf_property_settings_collec function in the structured file library. The GNOME Project’s libgsf allows a hacker to execute arbitrary code.

Vulnerability of the gsfpropertysettingscollec function in the structured file library: The GNOME Project’s libgsf is vulnerable to buffer overflow in dynamic memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

com.farao-community.farao:csa-runner-api (>=1.2.1 <=2.6.1), com.farao-community.farao:csa-runner-app (>=1.2.1 <=2.6.1) +268 more potentially affected by CVE-2025-48058 via com.powsybl:powsybl-commons (>=6.0.0-RC1 <=6.7.1)

com.powsybl:powsybl-commons MAVEN version =6.0.0-RC1, =1.2.1, =1.2.1, =4.6.1, =4.6.1, =4.6.0, =4.6.1, =4.6.0, =4.6.1, =4.6.1, =4.6.1, =4.6.1, =4.6.0, =4.6.1, =4.6.1, =4.6.1, =5.0.0 and more Source cves: CVE-2025-48058 Source advisory: SNYK:JAVA-COMPOWSYBL-10442140...

ROS-20250619-08

The h11 library vulnerability is related to flaws in HTTP request processing. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality and integrity of protected information. of protected information...

Arbitrary Argument Injection

Overview cloudinary is a Cloudinary NPM for node.js integration Affected versions of this package are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampersand. An attacker can inject additional, unintended parameters. This could lead to a...

TencentOS Server 2: python-idna (TSSA-2024:0673)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0673 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

TencentOS Server 3: brotli (TSSA-2022:0118)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0118 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools allows attackers to perform XXE attacks.

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...

CVE-2025-44091

yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting XSS via the role management function...

Medium: perl-FCGI

Issue Overview: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 aka fcgi library. The included FastCGI library is affected by CVE-2025-23016, causing an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in...

Insertion of Sensitive Information Into Sent Data

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data. Go Vulnerability Report: Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially...

CVE-2024-47081

Requests is a HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be...

perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

A flaw was found in the FCGI library. In affected versions, specially crafted nameLen or valueLen values in data sent to the IPC socket may result in a heap-based buffer overflow, which can cause an application crash or other undefined behavior. This occurs in ReadParams in fcgiapp.c...

CVE-2025-21082

in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion...

org.webjars:angular-markdown-directive (=0.3.0) potentially affected by CVE-2025-2336 via org.webjars:angular-sanitize (=1.2.16)

org.webjars:angular-sanitize MAVEN version =1.2.16 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:angular-sanitize and may be impacted: - org.webjars:angular-markdown-directive =0.3.0 Source cves: CVE-2025-2336 Source advisory:...

📄 PSF Request Library Credential Leak

The PSF requests library leaks .netrc credentials to third parties due to incorrect URL processing under specific conditions. The PSF requests library https://github.com/psf/requests & https://pypi.org/project/requests/ leaks .netrc credentials to third parties due to incorrect URL processing und...