Cpanel 安全漏洞

Cpanel is a set of automated web-based colocation platforms from Cpanel, Inc. in the United States. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in cPanel versions 110 through 132, which stems from the existence of directory...

CVE-2025-66626

Argo Workflows CVE-2025-66626 affects the container-native workflow engine. Versions ≤3.6.13 and 3.7.0–3.7.4 contain unsafe untar code that mishandles symbolic links, allowing an attacker to overwrite /var/run/argo/argoexec with a script executed at pod startup. The patch for CVE-2025-62156 is in...

SiYuan 路径遍历漏洞

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A path traversal vulnerability exists in SiYuan 0.0.0-20251202123337-6ef83b42c7ce and prior versions, which stems from a ZipSlips vulnerability that could lead to arbitrary file overwrites...

Whose Narrative Is It Anyway? A KV Cache Manipulation Attack

The Key ValueKV cache is an important component for efficient inference in autoregressive Large Language Models LLMs, but its role as a representation of the model's internal state makes it a potential target for integrity attacks. This paper introduces "History Swapping," a novel block-level...

Argument Injection

@conventional-changelog/git-client is vulnerable to Argument Injection. The vulnerability is due to improper handling of user-controlled parameters in the getTags API, due to the library failing to sanitize input, allowing attackers to inject arbitrary git arguments such as --output= and overwrit...

MAL-2025-53884 Malicious code in ogi-nasipecel71-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0ad17aafa3d51058b4a696d1ec63ab0a79a5023b76ff2ceaebf9cdbd924af9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

U.S. Dept Of Defense: DNN - Unrestricted Arbitrary File Upload #████████

A vulnerability was discovered in versions of DNN formerly DotNetNuke prior to 10.1.1. The vulnerability was caused by the default HTML editor provider allowing unauthenticated file uploads and overwriting of existing files. This could have led to website defacement and cross-site scripting attac...

EUVD-2025-36564

DNN Insufficient Access Control - Image Upload allows for Site Content Overwrite...

CVE-2025-64095

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and replace existing files...

CVE-2025-42937 Directory Traversal vulnerability in SAP Print Service

SAP Print Service SAPSprint performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application...

Directory Traversal

Overview bbot is an OSINT automation for hackers. Affected versions of this package are vulnerable to Directory Traversal via gitdumper. An attacker can execute arbitrary commands by crafting a malicious git repository. Details A Directory Traversal attack also known as path traversal aims to...

EUVD-2020-17754

Malware in sbrugna...

EUVD-2019-16238

Malware in sbrugna...

CVE-2025-34251

CVE-2025-34251 : Affected product is Tesla Telematics Control Unit (TCU) firmware prior to 2025.14. The root cause is an authentication bypass allowing the Android Debug Bridge (adbd) to run as root despite a lockdown check; adb push/pull and adb forward remain usable, and the USB port is exposed...

EUVD-2022-0942

Malicious code in bioql PyPI...

EUVD-2025-8214

Malicious code in bioql PyPI...

EUVD-2022-26062

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2022-26240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The default privileges for the running service Normand Message Buffer in Beckman Coulter Remisol Advance v2.0.12.1 and prior allows non-privileged users to...

PYSEC-2025-140

MONAI Medical Open Network for AI is an AI toolkit for health care imaging. The extractall function zipfile.extractalloutputdir is used directly to process compressed files. It is used in many places in the project. In versions up to and including 1.5.0, when the Zip file containing malicious...

MONAI 路径遍历漏洞

MONAI is a medical imaging AI toolkit open-sourced by Project MONAI. A path traversal vulnerability exists in MONAI 1.5.0 and earlier versions, which stems from improper handling of the extractall function and can lead to system file overwrites...