Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect due to a failure to validate the redirectto parameter. An attacker can exfiltrate user cookies by tricking a user into authenticating with their SAML provider using a crafted link that redirects them to an...

GHSA-P46V-F2X8-QP98 pREST has a Systemic SQL Injection Vulnerability

Summary pREST provides a simple way for users to expose access their database via a REST-full API. The project is implemented using the Go programming language and is designed to expose access to Postgres database tables. During an independent review of the project, Doyensec engineers found that...

Linux Distros Unpatched Vulnerability : CVE-2024-21803

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM bluetooth modules allows Local Execution of Code. This vulnerability is associated...

Linux Distros Unpatched Vulnerability : CVE-2025-7207

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability, which was classified as problematic, was found in mruby up to 3.4.0-rc2. Affected is the function scopenew of the file...

CVE-2025-7207

Summary (CVE-2025-7207): A heap-based buffer overflow affects mruby up to 3.4.0-rc2, specifically the function scope_new in file mrbgems/mruby-compiler/core/codegen.c (component nregs Handler). The vulnerability can be triggered locally; an attack requires local access, and the exploit has been d...

mruby 安全漏洞

mruby is a lightweight implementation of the Ruby language. A security vulnerability exists in mruby 3.4.0-rc2 and earlier versions, which stems from a heap buffer overflow in the scopenew function...

PT-2025-37240

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.16.0-rc2 Description: A flaw exists in the Linux kernel related to PCI endpoint configuration file system configfs group list head handling. An incorrect list del call within pci epf remove cfs can trigger a...

CVE-2022-28936

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node can trigger an integer overflow and cause a Denial of Service DoS via an unusually large viewchange message packet...

SUSE CVE-2025-32431

Traefik pronounced traffic is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backe...

SQL Injection

Overview shopware/platform is a Shopware e-commerce core. Affected versions of this package are vulnerable to SQL Injection through the aggregations object. An attacker can manipulate the SQL queries and potentially access or alter data by injecting malicious SQL code into the name field...

CVE-2025-21949

The CVE-2025-21949 entries describe a LoongArch-specific Linux kernel flaw where the base address for hugetlb mmap is not aligned with the pmd size. The issue manifests in the hugetlb handling path (mm/hugetlb.c) and affected scenario involves the test case testcases/bin/hugefork02, where a kerne...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. An access control error vulnerability exists in LibreChat version v0.7.5-rc2, which stems from the Delete Attachment feature not validating the attachment ID, which could lead to a user deleting another person's attachment...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. A security vulnerability exists in LibreChat version v0.7.5-rc2, which stems from a preset creation feature that allows a user to manipulate the user ID field, potentially causing presets to appear in other user interfaces...

PT-2025-46594

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc2 1134 Description The Linux kernel contains a flaw in the ext4 file system related to memory management during initialization. Specifically, a null pointer dereference can occur in the ext4 mb init...

CVE-2024-53566: Improper Limitation of a Pathname to a Restricted Directory

An issue in the actionlistcategories function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal...

Improper Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authorization due to insufficient permission checks in the RSS feed management functionality. An attacker can manipulate or delete RSS feeds they should not have access to by exploiting the...

Information Exposure

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Information Exposure via the sendinstantmessages function. An attacker can gain access to user names they should not have access to by exploiting this error message handling. Remediation Upgrade...

CVE-2024-50256

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfrejectipv6: fix potential crash in nfsendreset6 I got a syzbot report without a repro 1 crashing in nfsendreset6 I think the issue is that dev-hardheaderlen is zero, and we attempt later to push an Ethernet header. U...

SUSE CVE-2024-47827

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerabili...

CVE-2024-47827

A flaw was found in Argo Workflows. Due to a race condition in a global variable, the Argo Workflows controller can crash on command by any user with access to execute a workflow, which can lead to a denial of service...