CVE-2025-46393

A flaw was found the inImageMagick package. In multispectral MIFF image processing in ImageMagick, packetsize is mishandled. This issue is related to the rendering of all channels in an arbitrary order. Mitigation Mitigation for this issue is either not available or the currently available option...

CVE-2025-43965

A flaw was found in ImageMagick. In MIFF image processing in ImageMagick, image depth is mishandled after SetQuantumFormat is used. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of...

CVE-2024-47829

A flaw was found in the pnpm package manager. In the affected versions, the path shortening function utilizes the MD5 hashing algorithm for compressing paths. If a collision occurs, this can lead to two different libraries being stored in the same path. Although the real names of these libraries...

CVE-2025-46421

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect. Mitigation Currently, no...

CVE-2025-46420

A flaw was found in libsoup. It is vulnerable to memory leaks in the soupheaderparsequalitylist function when parsing a quality list that contains elements with all zeroes. Mitigation Currently, no mitigation is available for this vulnerability...

WordPress Flynax Bridge plugin <= 2.2.0 - Unauthenticated Privilege Escalation via Account Takeover vulnerability

Unauthenticated Privilege Escalation via Account Takeover vulnerability discovered by kr0d in WordPress Plugin Flynax Bridge versions = 2.2.0...

CVE-2025-21605

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the outpu...

Regulating AI Behavior with a Hypervisor

Interesting research: "Guillotine: Hypervisors for Isolating Malicious AIs." Abstract :As AI models become more embedded in critical sectors like finance, healthcare, and the military, their inscrutable behavior poses ever-greater risks to society. To mitigate this risk, we propose Guillotine, a...

CVE-2025-21605 Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the outpu...

CVE-2025-21605 Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client

Redis is an open source, in-memory database that persists on disk. In versions starting at 2.6 and prior to 7.4.3, An unauthenticated client can cause unlimited growth of output buffers, until the server runs out of memory or is killed. By default, the Redis configuration does not limit the outpu...

CVE-2025-3454

This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with minimal permissions could gain unauthorized read access to GET endpoints in Alertmanager and Prometheus datasources. The issue primarily...

CVE-2025-2703

A DOM-based Cross-site scripting vulnerability exists in Grafana's built-in XY Chart plugin. This flaw allows an attacker with editor-level privileges to inject and execute arbitrary JavaScript code by editing an XY Chart Panel. The vulnerability bypasses the Content Security Policy, allowing the...

CVE-2024-10306

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

CVE-2024-33452

A flaw was found in the OpenResty lua-nginx-module. Affected versions of this component allow a remote attacker to conduct HTTP request smuggling via a crafted HEAD request. The attacker can use this attack to bypass any frontend proxy protection, serve malicious responses to all the users in the...

Apache Parquet 2.9.0 Remote Code Execution

Apache Parquet versions 2.9.0 and below educational simulation of CVE-2025-30065, a critical remote code execution vulnerability in Apache Parquet files. The tool demonstrates how attackers exploit this flaw to gain full system control, while providing mitigation guidance...

GHSA-JX4G-3XQM-62VH io.jmix.localfs:jmix-localfs has a Path Traversal in Local File Storage

Impact Attackers could manipulate the FileRef parameter to access files on the system where the Jmix application is deployed, provided the application server has the necessary permissions. This can be accomplished either by modifying the FileRef directly in the database or by supplying a harmful...

WordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Popup Builder versions = 1.1.35...

GHSA-MXR3-8WHJ-J74R Harden-Runner allows evasion of 'disable-sudo' policy

Summary Harden-Runner includes a policy option disable-sudo to prevent the GitHub Actions runner user from using sudo. This is implemented by removing the runner user from the sudoers file. However, this control can be bypassed as the runner user, being part of the docker group, can interact with...

PT-2025-17563 · Unknown · Student Study Center Desk Management System

Name of the Vulnerable Software and Affected Versions: Student Study Center Desk Management System version 1.0 Description: The issue allows attackers to bypass authentication via a crafted GET request to "/php-sscdms/admin/login.php". This enables unauthorized access to the system...

PT-2025-27553 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.16 multi Description: The issue is related to a Buffer Overflow in the addWifiMacFilter function, which can be exploited via the deviceId parameter. Recommendations: For Tenda AC6 version 15.03.05.16 multi, as a...