Litespeed Technologie LiteSpeed QUIC (LSQUIC) security vulnerabilities

Litespeed Technologie LiteSpeed QUIC LSQUIC is an open source implementation of QUIC and HTTP/3 functionality for servers and clients from Litespeed Technologie, USA. A security vulnerability exists in Litespeed Technologie LiteSpeed QUIC LSQUIC prior to version 4.2.0 that stems from the presence...

CVE-2025-27092 Path Traversal Vulnerability in GHOSTS Photo Retrieval Endpoint

GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered in GHOSTS version 8.0.0.0 that allows an attacker to access files outside of the intended directory through the photo retrieval endpoint...

CVE-2025-26607

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, documentoexcluir.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

CVE-2025-26605 SQL Injection endpoint 'deletar_cargo.php' parameter 'id_cargo' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, deletarcargo.php endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access...

CVE-2025-26607 SQL Injection endpoint 'documento_excluir.php' parameter 'id_funcionario' in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, documentoexcluir.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized...

CVE-2025-26613

CVE-2025-26613 affects WeGIA (Web Manager for Institutions). The OS Command Injection is exposed via the gerenciar_backup.php endpoint, allowing remote code execution. The issue is addressed in WeGIA v3.2.14; upgrade to 3.2.14 is recommended. A temporary workaround from PT-Security suggests restr...

CVE-2025-26613 OS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIA

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, gerenciarbackup.php endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. This issue ha...

Malicious code in elastic-buildkite-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 889d976fe581d0e221dc91fb52cc010669d68189ba293e437a6966b6decd515f The OpenSSF Package Analysis project identified 'elastic-buildkite-manager' @ 2.0.0 npm as malicious. It is considered malicious because: - The...

Apache James Resource Management Error Vulnerability

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . Apache James suffers from a Resource Management Error vulnerability that stems from uncontrolled resource consumption by the application,...

ChurchCRM security vulnerabilities

ChurchCRM is ChurchCRM open source an open source CRM system for churches. ChurchCRM suffers from an input validation error vulnerability that stems from not properly validating input. An attacker can exploit this vulnerability to hijack a user session...

ZOO-Project Path Traversal Vulnerability

ZOO-Project is an open source processing platform from ZOO-Project Open Source. ZOO-Project suffers from a path traversal vulnerability that stems from not properly validating a file path. An attacker can read arbitrary files by exploiting this vulnerability...

Malicious code in linter-coffee-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 292d0ff0a104c6e415fc2ea734ec189f699d6aecb4383502759e2053adddfb45 The OpenSSF Package Analysis project identified 'linter-coffee-variables' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Google Android suffers from unspecified vulnerability (CNVD-2025-03648)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to elevate privileges...

Google Android elevation of privilege vulnerability (CNVD-2025-05219)

Google Android is a Linux-based open source operating system from Google. Google Android has a security vulnerability that can be exploited by attackers to elevate privileges...

Codezips Gym Management System injection vulnerability

Codezips Gym Management System is an open source gym management system from Codezips. An injection vulnerability exists in Codezips Gym Management System version 1.0, which stems from the fact that incorrect manipulation of the parameter name can lead to SQL injection...

Daily Expense Tracker System SQL Injection Vulnerability (CNVD-2025-31004)

Daily Expense Tracker System is a PHP and MySQL based daily expense tracking system. Daily Expense Tracker System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the dateexpense parameter in /dets/add-expense.php. No details ...

Code-Projects Real Estate Property Management System Injection Vulnerabilities

Code-Projects Real Estate Property Management System is an open source real estate property management system from Code-Projects. An injection vulnerability exists in Code-Projects Real Estate Property Management System version 1.0, which stems from an incorrect manipulation of the parameter city...

[SECURITY] Fedora 40 Update: chromium-133.0.6943.98-1.fc40

Chromium is an open-source web browser, powered by WebKit Blink...

[SECURITY] Fedora 41 Update: chromium-133.0.6943.98-1.fc41

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2025-25206

eLabFTW is an open source electronic lab notebook for research labs. Prior to version 5.1.15, an incorrect input validation could allow an authenticated user to read sensitive information, including login token or other content stored in the database. This could lead to privilege escalation if...