Blood Bank Management System 安全漏洞

Blood Bank Management System is a blood bank management system by shridhar shukla individual developer. A security vulnerability exists in Blood Bank Management System version 1.0, which stems from the login.php component not cleaning up user input, which could lead to a cross-site scripting atta...

Hello Video Codec 安全漏洞

Hello Video Codec is a video codec from Tempus Ex open source. A security vulnerability exists in Hello Video Codec version v0.1.0, which stems from improper validation of inputs to the BitstreamWriter::writebits function, which could lead to a denial of service attack...

FeehiCMS 安全漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.1.1, which originates from a reverse tag hijacking issue in the Comments Management function...

OpenVPN 安全漏洞

OpenVPN is a software package for creating encrypted tunnels for virtual private networks VPNs from US-based OpenVPN, which uses the OpenSSL library to encrypt data and control information and allows the created VPN to be authenticated using a public key, an electronic certificate, or a...

PT-2025-48454

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes...

Elevate Your Cloud Security Strategy

Learn to elevate your cloud security strategy & overcome complexity with Vision One™...

FeehiCMS 安全漏洞

FeehiCMS is a Php-based CMS website builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.1.1, which stems from the server-side failure to implement immutability for read-only parameters, which could lead to user name modification...

Fedora: Security Advisory (FEDORA-2025-bc8b81c28d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for java-21-openjdk (important)

openSUSE security update: security update for java-21-openjdk ------------------------------------------------------------- Announcement ID: openSUSE-SU-2025-20123-1 Rating: important References: bsc1246806 bsc1252414 bsc1252417 bsc1252418 Cross-References: CVE-2025-53057 CVE-2025-53066...

CVE-2025-13790 Scada-LTS cross-site request forgery

A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure...

EUVD-2025-199923

In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration date...

CVE-2025-66422

Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back server setup information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70...

[SECURITY] Fedora 42 Update: drupal7-7.103-1.fc42

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 41 Update: drupal7-7.103-1.fc41

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

WordPress BERTHA AI plugin <= 1.13 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin BERTHA AI versions = 1.13...

CVE-2025-53896

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a user's active session would not properly time out due to inactivity. This issue has been patched in version 9.1.0...

CVE-2025-53899

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified destination in a communication channel which allows an attacker with administrative privileges on the system under certain circumstances t...

CVE-2025-66221 Werkzeug safe_join() allows Windows special device names

Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safejoin function allows path segments with Windows device names. On Windows, there are special device names such as CON, AUX, etc that are implicitly present and readable in every directory...

CVE-2025-53939 Kiteworks Core is vulnerable to Improper Input Validation

Kiteworks is a private data network PDN. Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly elevate another user's permissions on the share. This issue has been patched in version 9.1.0...

CVE-2025-53900 Kiteworks MFT has a Privilege Defined With Unsafe Actions

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0...