CVE-2025-32381

A flaw was found in Xgrammar. This vulnerability allows a denial of service DoS via unbounded memory usage when handling a large number of unique grammar inputs from untrusted sources. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2025-32379

A flaw was found in Koa. This vulnerability allows execution of arbitrary JavaScript code via crafted user input passed to the ctx.redirect function, even after input sanitization. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red...

CVE-2025-27391

A flaw was found in Apache ActiveMQ Artemis. This vulnerability allows an attacker with access to debug logs to obtain sensitive configuration information via debug-level logging of broker properties. Mitigation Mitigation for this issue is either not available or the currently available options ...

WordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by thiennv in WordPress Plugin Easy Post Duplicator versions = 1.0.1...

CVE-2025-32016

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016 Microsoft Identity Web Exposes Client Secrets and Certificate Information in Service Logs

Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity platform formerly Azure AD v2.0 endpoint and AAD B2C. This vulnerability affects confidential client applications, including daemons, web...

CVE-2025-32016

This CVE affects Microsoft Identity Web (and related Microsoft.Identity.Abstractions) used with ASP.NET Core for Azure AD v2.0 / AAD B2C integrations. Under certain conditions, service logs can expose sensitive credentials, including local file paths with passwords, Base64-encoded values, and Cli...

WordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerability

SQL Injection vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Duplicate Title Checker versions = 1.2...

WordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by LVT-tholv2k in WordPress Plugin Database Toolset versions = 1.8.4...

CVE-2025-22871

A flaw was found in the net/http golang package. The net/http package incorrectly accepts messages that end with a line feed LF instead of the proper line ending. When used with another server that also misinterprets this, it can lead to request smuggling—where an attacker tricks the system to se...

CVE-2025-32464

A flaw was found in the HAProxy. This issue can allow a buffer overflow via improper length checking when replacing multiple regex back-references in a string. Specifically, the replacement size is incorrectly validated against the output buffer instead of the temporary trash buffer used during...

CVE-2025-32460

GraphicsMagick before 8e56520 has a heap-based buffer over-read in ReadJXLImage in coders/jxl.c, related to an ImportViewPixelArea call. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising eas...

ECA: Event - Condition - Action - Critical - Cross site request forgery - SA-CONTRIB-2025-031

This module enables you to define automations on your Drupal site. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability can be mitigated by disabling the "ecaui" submodule, which leaves ECA functionality intact, but the vulnerable routes will no longer be...

PT-2025-15738 · Bhoogterp · Bhoogterp

Name of the Vulnerable Software and Affected Versions: bhoogterp Scheduled versions n/a through 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web application,...

CVE-2025-30307 XMPWorker | Out-of-bounds Read (CWE-125)

XMP Toolkit versions 2023.12 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim...

CVE-2025-27202

Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a vict...

CVE-2025-30303

Summary: CVE-2025-30303 affects Adobe FrameMaker up to 2020.8 and 2022.6 and earlier, due to an out-of-bounds read that can disclose memory. Impact is memory disclosure; mitigations like ASLR may be bypassed. Exploitation requires user interaction (victim opens a malicious file). Connected source...

CVE-2025-29479

A flaw was found in the Hiredis library. This vulnerability allows a local attacker to cause a denial of service via crafted input data that triggers a heap buffer overflow during Redis command formatting. Mitigation Mitigation for this issue is either not available or the currently available...

Multi-Vendor BIOS Security Vulnerabilities (April 2025) - Lenovo Support US

No description provided...

CVE-2025-29478

A flaw was found in Fluent Bit's YAML configuration parser. This vulnerability allows attackers to cause a heap use-after-free, potentially leading to denial of service via a crafted YAML input file. Mitigation Mitigation for this issue is either not available or the currently available options d...