CVE-2025-48071

A heap based-buffer overflow flaw was found in OpenEXR. In affected versions, there is a heap-based buffer overflow during a write operation when decompressing ZIPS-packed deep-scan-line EXR files with a maliciously forged chunk header. Mitigation Mitigation for this issue is either not available...

CVE-2025-48072

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Version 3.3.2 is vulnerable to a heap-based buffer overflow during a read operation due to bad pointer math when decompressing DWAA-packed scan-line EXR...

CLSA-2025-1753988282 avahi: Fix of CVE-2024-52616

CVE-2024-52616: initialize DNS transaction IDs randomly at each startup to prevent predictability and mitigate DNS spoofing attacks...

MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

Description A Remote Code Execution RCE vulnerability exists in the modelscope/ms-swift project due to unsafe use of yaml.load in combination with vulnerable versions of the PyYAML library ≤ 5.3.1. The issue resides in the tests/run.py script, where a user-supplied YAML configuration file is...

GHSA-FM6C-F59H-7MMG MS SWIFT Remote Code Execution via unsafe PyYAML deserialization

Description A Remote Code Execution RCE vulnerability exists in the modelscope/ms-swift project due to unsafe use of yaml.load in combination with vulnerable versions of the PyYAML library ≤ 5.3.1. The issue resides in the tests/run.py script, where a user-supplied YAML configuration file is...

Güralp Systems FMUS Series and MIN Series Devices (Update B)

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

CVE-2025-54576

An authentication bypass flaw was found in the OAuth2-Proxy project. This bypass affects systems that have configured their deployment to skip authentication on endpoints that match a deployment-defined regular expression. HTTP parameters can be used to match and trigger the authentication bypass...

CVE-2025-54410

A firewall state management issue was found in the Moby project. When firewalld reloads, Docker fails to recreate iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This issue breaks...

CVE-2025-54388

A firewall state management issue was found in the Moby project. When the firewalld service is reloaded, it removes all iptables rules, including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block...

Exploit for Improper Privilege Management in Sudo_Project Sudo

CVE-2023-22809-automated-python-exploits automatically exploit...

Exploit for Use After Free in Microsoft

🚨 CVE-2025-29824 Exploit: PipeMagic Ransomware Chain 📌 Critical...

CVE-2025-4674

A flaw was found in cmd/go. The go command can execute arbitrary commands when processing untrusted version control system VCS repositories containing malicious configuration. This issue occurs because the command interprets VCS metadata, potentially leading to unintended command execution. This...

CVE-2025-8217 Inert Malicious script injected into Amazon Q Developer Visual Studio Code (VS Code) Extension

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

📄 Create School Management System 1.0 Cross Site Scripting

Create School Management System version 1.0 suffers from a persistent cross site scripting vulnerabilities. Hello Full Disclosure community, I’m sharing details of a recently assigned CVE affecting a widely used open‑source School Management System PHP/MySQL...

APM Server (Windows Installer) 8.16.3, 8.17.1 Security Update (ESA-2025-01)

APM Server Uncontrolled Search Path Element can lead to Local Privilege Escalation LPE when using the Windows Installer ESA-2025-01 An uncontrolled search path element vulnerability can lead to local privilege Escalation LPE via Insecure Directory Permissions. The vulnerability arises from improp...

Bugsink path traversal via event_id in ingestion

Summary In affected versions, ingestion paths construct file locations directly from untrusted eventid input without validation. A specially crafted eventid can result in paths outside the intended directory, potentially allowing file overwrite or creation in arbitrary locations. Submitting such...

CVE-2025-7458

An integer overflow flaw has been discovered in SQLite. This flaw allows an attacker who has the ability to execute raw SQL statements to induce a denial of service or leak process memory. Mitigation Mitigation for this issue is either not available or the currently available options do not meet...

CVE-2025-46059

A prompt injection vulnerability was found in the Langchain AI project. Users who leverage the GmailToolkit component are at risk of an attacker creating a malicious email. This vulnerability could allow code execution in the context of the running Python application. Mitigation Mitigation for th...

Exploit for CVE-2025-47227

🔓 CVE-2025-47227 — Critical Admin Password Reset Bypass in Scr...

GHSA-W832-W3P8-CW29 z-push/z-push-dev SQL Injection Vulnerability

Versions of the package z-push/z-push-dev before 2.7.6 are vulnerable to SQL Injection due to unparameterized queries in the IMAP backend. An attacker can inject malicious commands by manipulating the username field in basic authentication. This allows the attacker to access and potentially modif...