1000 Projects Daily College Class Work Report Book – Injection Vulnerabilities

1000 Projects Daily College Class Work Report Book is an open source college class work report book by 1000 Projects. An injection vulnerability exists in 1000 Projects Daily College Class Work Report Book version 1.0, which originates from SQL injection due to the operation of the parameter batc...

Gardener input validation vulnerability

Gardener is an open source Kubernetes cluster management tool from Gardener Open Source. The product supports managing, monitoring and updating Kubernetes clusters. An input validation error vulnerability exists in Gardener versions prior to 1.119.0, which stems from bypassing project secret...

Number withdrawal

Node.js is an open source, cross-platform JavaScript runtime environment from Node.js Open Source. This CVE number has been withdrawn...

Malicious code in evo-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1963187cd4dc65fd86ae4bdae898bd2fea39e8e6a8464b3b00e2a83f5dcbb95b The OpenSSF Package Analysis project identified 'evo-web' @ 100.0.2 npm as malicious. It is considered malicious because: - The package executes...

[SECURITY] Fedora 41 Update: chromium-136.0.7103.113-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 42 Update: chromium-136.0.7103.113-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

An In-Kernel Forensics Engine for Investigating Evasive Attacks

Over the years, adversarial attempts against critical services have become more effective and sophisticated in launching low-profile attacks. This trend has always been concerning. However, an even more alarming trend is the increasing difficulty of collecting relevant evidence about these attack...

Itsourcecode Sales and Inventory System Injection Vulnerability

itsourcecode Sales and Inventory System is itsourcecode open source a sales and inventory system . An injection vulnerability exists in itsourcecode Sales and Inventory System version 1.0, which results from SQL injection due to incorrect manipulation of the parameter serial in the file...

Code-Projects Pharmacy Management System security vulnerabilities

Code-Projects Pharmacy Management System is an open source pharmacy management system from Code-Projects. A security vulnerability exists in Code-Projects Pharmacy Management System version 1.0, which originates from a buffer overflow...

CVE-2025-47945

Donetick is an open‑source task/chores app. Before v0.1.44, it uses JWT authentication with a weak default signing secret, enabling potential full account takeover of any user. The live version confirms the issue. A patch is available in v0.1.44; recommended mitigation is upgrading to 0.1.44 or l...

CVE-2025-47945 Donetick Has Weak Default JWT Secret

Donetick an open-source app for managing tasks and chores. Prior to version 0.1.44, the application uses JSON Web Tokens JWT for authentication, but the signing secret has a weak default value. While the responsibility is left to the system administrator to change it, this approach is inadequate...

RAGFlow security vulnerabilities

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow version 0.18.1 and earlier, which stems from a brute force attack could lead to account takeover...

MAL-2025-3865 Malicious code in mfe-react-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7835d0f6b232544302030371ac74d4c595860a04736a2ef54259a32993f9c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SynFuzz: Leveraging Fuzzing of Netlist to Detect Synthesis Bugs

In the evolving landscape of integrated circuit IC design, the increasing complexity of modern processors and intellectual property IP cores has introduced new challenges in ensuring design correctness and security. The recent advancements in hardware fuzzing techniques have shown their efficacy ...

CVE-2025-47784

Emlog (open-source website building system) is affected by CVE-2025-47784 in versions 2.5.13 and earlier, due to a deserialization vulnerability. A crafted nickname can trigger str_replace to set name_orig to an empty value, causing deserialization to fail and return false. The issue is mitigated...

CVE-2025-47784 Emlog vulnerable to Deserialization of Untrusted Data

Emlog is an open source website building system. Versions 2.5.13 and prior have a deserialization vulnerability. A user who creates a carefully crafted nickname can cause strreplace to replace the value of nameorig with empty, causing deserialization to fail and return false. Commit...

Checkmate security vulnerabilities

Checkmate is an open source, self-hosted tool from BlueWave Open Source designed to track and monitor server hardware, uptime, response time and events in real-time with beautiful visualizations. A security vulnerability exists in Checkmate versions prior to 2.1 that stems from unrestricted acces...

ITSsourcecode Placement Management System injection vulnerability

itsourcecode Placement Management System is an open source placement management system by itsourcecode. An injection vulnerability exists in version 1.0 of itsourcecode Placement Management System, which originates from a SQL injection due to incorrect manipulation of the parameter ID in the file...

Modular Account security vulnerability

Modular Account is an open source application from Alchemy. A security vulnerability exists in Modular Account that stems from the allowlist module not checking the executeUserOp path, which could lead to bypassing access control restrictions...

Mattermost security vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a privilege issue vulnerability that stems from insufficient privilege validation, which can be exploited by an attacker to view group information via an API request...