CVE-2026-25925

PowerDocu (Windows GUI) is vulnerable before version 2.4.0 due to JSON deserialization in Flow/App packages. The app blindly trusts the $type property, allowing an attacker to instantiate arbitrary .NET objects and execute code. This yields high-severity, local, with user interaction required. Fi...

CVE-2026-25925 PowerDocu Affected by Remote Code Execution via Insecure Deserialization

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

CVE-2026-25925

PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to...

-fides-amor-et-lux (1.0.0), 0xppl-solana-portfolio (1.0.0) +13616 more potentially affected by CVE-2026-25639 via axios (>=1.0.0, <=1.13.4)

axios NPM version =1.0.0, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =2.0.0, =2.0.200 and more Source cves: CVE-2026-25639 Source advisory: SNYK:JS-AXIOS-15252993...

Updated nginx packages fix security vulnerability

MitM injection. CVE-2026-1642...

CVE-2025-66594

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS Packages: RVSVRN, UNSVRN,...

CVE-2025-66594

CVE-2025-66594 affects Yokogawa FAST/TOOLS packages (RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) from R9.01 to R10.04. The public description notes that detailed messages on the error page could be exploited by an attacker for other attacks, indicating information leakage or error handling weaknesses;...

CVE-2025-66595

CVE-2025-66595 affects Yokogawa FAST/TOOLS. The vulnerability is Cross-Site Request Forgery (CSRF) impacting FAST/TOOLS packages RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB from version R9.01 through R10.04. The available sources describe the issue and affected versions but do not provide a root cause ...

CVE-2025-66600

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS HTTP Strict Transport Security configuration. When an attacker performs a Man in the middle MITM attack, communications with the web server could be sniffed. The affected products and...

CVE-2025-66605

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete attribute enabled, the input content could be saved in the browser the user is using. The affected products and versions are as follows:...

Linux Distros Unpatched Vulnerability : CVE-2026-2239

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. Heap-buffer-overflow vulnerability exists in the freadpascalstring function when processing a specially crafted PSD Photoshop Document...

Critical Photon OS Security Update - PHSA-2026-4.0-0959

Updates of 'libtiff', 'linux', 'ImageMagick' packages of Photon OS have been released...

PT-2026-7059

Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software displays detailed messages on error pages. This information could be used by attackers for further malicious activities. Recommendations Update to a version later than R10.04...

PT-2026-7060

A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to Cross-Site Request Forgery CSRF. When a user accesses a link crafted by an attacker, the user’s account could be compromised. The affected products and versions are as follows:...

PT-2026-7179

Name of the Vulnerable Software and Affected Versions PowerDocu versions prior to 2.4.0 Description PowerDocu, a Windows GUI executable for technical documentation, has a security issue in its JSON parsing process within Flow or App packages. The application incorrectly trusts the $type property ...

org.webjars.npm:asn1.js (>=4.0.0, <=5.4.1), org.webjars.npm:asn1.js-rfc5280 (3.0.0) +26 more potentially affected by CVE-2026-2739 via org.webjars.npm:bn.js (>=4.11.6, <=5.2.0)

org.webjars.npm:bn.js MAVEN version =4.11.6, =4.0.0, =4.0.1, =4.0.0, =5.0.0, =6.2.3, =6.6.1 - org.webjars.npm:ethereum-cryptography 0.1.3 - org.webjars.npm:ethers 5.4.6 - org.webjars.npm:ethersprojectaddress 5.4.0 - org.webjars.npm:ethersprojectbignumber 5.4.1 and more Source cves: CVE-2026-2739...

SUSE CVE-2026-25121

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...

Malicious Package

Overview @sporting-life/sportinglife-betslip-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

SUSE-SU-2026:20338-1 Security update for cockpit-packages

This update for cockpit-packages fixes the following issues: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257325...

OPENSUSE-SU-2026:20185-1 Security update for cockpit-packages

This update for cockpit-packages fixes the following issues: - CVE-2025-13465: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global bsc1257325...