Model Context Protocol Servers 路径遍历漏洞

Model Context Protocol Servers is a large model context protocol server from Model Context Protocol open source. A path traversal vulnerability exists in versions of Model Context Protocol Servers prior to 2025.12.17, which stems from a failure to verify that the repopath parameter in subsequent...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand 4.0.8 and earlier versions, which originates when the Apache proxy passes sensitive headers to the origin server, potentially leadin...

PT-2025-51928

Name of the Vulnerable Software and Affected Versions ChurchCRM versions prior to 6.5.3 Description ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message, including the host, IP address, username, and password...

Open Source Point of Sale 跨站请求伪造漏洞

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site request forgery vulnerability exists in Open Source Point of Sale versions prior to 3.4.2, which stems from an explicit disabling of the CSRF protection mechanism, which could lead to a...

Open Source Point of Sale 安全漏洞

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A security vulnerability exists in Open Source Point of Sale version v3.4.1, which stems from improper handling of the name parameter in the Create/Update Items module, which could lead to a cross-site...

Open Source Point of Sale 安全漏洞

Open Source Point of Sale is a web-based point of sale system. A security vulnerability exists in Open Source Point of Sale version 3.4.1, which stems from an unvalidated name parameter and could lead to a cross-site scripting attack...

AVideo 安全漏洞

AVideo is an open source broadcast network creation tool from World Wide Broadcast Network. A security vulnerability exists in AVideo versions prior to 20.0, which stems from multiple public API endpoints leaking absolute filesystem paths, potentially exposing the underlying filesystem structure...

CVE-2025-66923

A Cross-site scripting XSS vulnerability in Create/Update Customers in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phonenumber parameter...

CVE-2025-66924

A Cross-site scripting XSS vulnerability in Create/Update Item Kits in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter...

Open Source Point of Sale 跨站脚本漏洞

Open Source Point of Sale is an open source web-based point of sale system from opensourcepos. A cross-site scripting vulnerability exists in Open Source Point of Sale versions 3.4.0 through prior to 3.4.2, which stems from a return policy configuration field that is not properly cleared of user...

CVE-2025-66921

CVE-2025-66921 describes a Cross-site scripting (XSS) vulnerability in the Open Source Point of Sale (OSPOS) v3.4.1, specifically in the Create/Update Item(s) Module. The issue arises from improper handling of the name parameter, allowing remote attackers to inject arbitrary web script or HTML. M...

CVE-2025-67895

creationtimestamp| type| source ---|---|--- 2025-12-16 15:13:17+00:00| seen| https://seclists.org/oss-sec/2025/q4/280 2025-12-17 13:42:16+00:00| seen| https://gist.github.com/Darkcrai86/3e68b0ba666c48a6963c4bbdca1c90c3 2025-12-17 15:12:00+00:00| seen|...

Security Bulletin: IBM Cognos Dashboards on Cloud Pak for Data has addressed security vulnerabilities.

Summary There are vulnerabilities in IBM® Java™, IBM® Semeru Runtime and Open-Source Software OSS components used by IBM Cognos Dashboards on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2024-7254 DESCRIPTION: Any project that parses untrusted Protocol Buffers data containing an arbitrary...

[SECURITY] Fedora 43 Update: chromium-143.0.7499.109-2.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

EUVD-2025-203487

ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent HTTP responses. This information disclosure significantly increases the risk of credential compromise and may amplify the impact of other...

EUVD-2025-203488

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exists in the Mermaid diagram rendering component that allows arbitrary JavaScript execution. Due to the exposure of the Electron IPC renderer...

Grassroot DICOM 安全漏洞

Grassroot DICOM is a Sourceforge open source C++ library for DICOM medical files. A security vulnerability exists in Grassroot DICOM version 3.024, which stems from an out-of-bounds read in the Overlay function that could lead to information disclosure...

HAL -- an Open-Source Framework for Gate-Level Netlist Analysis

HAL is an open-source framework for gate-level netlist analysis, an integral step in hardware reverse engineering. It provides analysts with an interactive GUI, an extensible plugin system, and APIs in both C++ and Python for rapid prototyping and automation. In addition, HAL ships with plugins f...

Allsky Camera 安全漏洞

Allsky Camera is an Allsky open source camera system for photographing and monitoring the entire sky. A security vulnerability exists in Allsky Camera version v2024.12.0606, which originates from path traversal and could lead to arbitrary command execution...

Wave Terminal 路径遍历漏洞

Wave Terminal is an enterprise collaboration system from the Wave Terminal open source. A path traversal vulnerability exists in Wave Terminal, which stems from a path traversal in the alog script that could result in reading or deleting files...